NASA/TP-2007-213475 



Synthesis from Design Requirements of a Hybrid System 
for Transport Aircraft Longitudinal Control 

Volume II 

Charles S. Hynes and Gordon H. Hardy 
Ames Research Center, Moffett Field, California 

Lance Sherry 

Honeywell International Inc., Phoenix, Arizona 


December 2007 


The NASA STI Program Office ... in Profile 


Since its founding, NASA has been dedicated to the 
advancement of aeronautics and space science. The 
NASA Scientific and Technical Information (STI) 
Program Office plays a key part in helping NASA 
maintain this important role. 

The NASA STI Program Office is operated by 
Langley Research Center, the Lead Center for 
NASA’s scientific and technical information. The 
NASA STI Program Office provides access to the 
NASA STI Database, the largest collection of 
aeronautical and space science STI in the world. 
The Program Office is also NASA’s institutional 
mechanism for disseminating the results of its 
research and development activities. These results 
are published by NASA in the NASA STI Report 
Series, which includes the following report types: 

• TECHNICAL PUBLICATION. Reports of 
completed research or a major significant phase 
of research that present the results of NASA 
programs and include extensive data or theoreti- 
cal analysis. Includes compilations of significant 
scientific and technical data and information 
deemed to be of continuing reference value. 
NASA’s counterpart of peer-reviewed formal 
professional papers but has less stringent 
limitations on manuscript length and extent 

of graphic presentations. 

• TECHNICAL MEMORANDUM. Scientific and 
technical findings that are preliminary or of 
specialized interest, e.g., quick release reports, 
working papers, and bibliographies that contain 
minimal annotation. Does not contain extensive 
analysis. 

• CONTRACTOR REPORT. Scientific and 
technical findings by NASA-sponsored 
contractors and grantees. 


• CONFERENCE PUBLICATION. Collected 
papers from scientific and technical confer- 
ences, symposia, seminars, or other meetings 
sponsored or cosponsored by NASA. 

• SPECIAL PUBLICATION. Scientific, technical, 
or historical information from NASA programs, 
projects, and missions, often concerned with 
subjects having substantial public interest. 

• TECHNICAL TRANSLATION. English- 
language translations of foreign scientific and 
technical material pertinent to NASA’s mission. 

Specialized services that complement the STI 
Program Office’s diverse offerings include creating 
custom thesauri, building customized databases, 
organizing and publishing research results . . . even 
providing videos. 

For more information about the NASA STI 
Program Office, see the following: 

• Access the NASA STI Program Home Page at 
http://www.sti.nasa.gov 

• E-mail your question via the Internet to 
help@sti.nasa.gov 

• Fax your question to the NASA Access Help 
Desk at (30 1)62 1-0 134 

• Telephone the NASA Access Help Desk at 
(301)621-0390 

• Write to: 

NASA Access Help Desk 
NASA Center for AeroSpace Information 
7115 Standard Drive 
Hanover, MD 21076-1320 


NASA/TP-2007-213475 



Synthesis from Design Requirements of a Hybrid System 
for Transport Aircraft Longitudinal Control 

Volume II 

Charles S. Hynes and Gordon H. Hardy 
Ames Research Center, Moffett Field, California 

Lance Sherry 

Honeywell International Inc., Phoenix, Arizona 


National Aeronautics and 
Space Administration 

Ames Research Center 

Moffett Field, California 94035-1000 


December 2007 


Acknowledgments 


Wc thank Michael Heymann for suggesting the investigation of validity regions in state space, and for many 
discussions. Charles E. Billings, William Bjorkman, James Franklin, Charles W. (Bill) Harper, Feng Lin, George 
Meyer, and Everett Palmer reviewed the report and provided useful comments on both content and presentation. 
We arc grateful to them all. 


Available from: 

NASA Center for AeroSpace Information 
7115 Standard Drive 
Hanover, MD 21076-1320 
(301) 621-0390 


National Technical Information Service 
5285 Port Royal Road 
Springfield, VA 22161 
(703) 487-4650 


TABLE OF CONTENTS 


VOLUME II 

LIST OF ACRONYMS ix 

LIST OF SYMBOLS ix 

APPENDIX A 

THE STANDARD ATMOSPHERE 

BASIC EQUATIONS A-I 

DEFINING PROPERTIES AND CONSTANTS A-2 

DEFINING EQUATIONS FOR THE TROPOSPHERE A-3 

DEFINING EQUATIONS FOR THE STRATOSPHERE A-4 

STANDARD ATMOSPHERE TABLE A-4 

REFERENCES A-6 

APPENDIX B 

ELEMENTS OF TRANSPORT AIRCRAFT DESIGN AND OPERATION 

INTRODUCTION B-l 

LONGITUDINAL EQUATIONS OF MOTION B-2 

AERODYNAMIC FORCES B-6 

Similarity in Fluid Mechanics B-6 

Aerodynamic Force Characteristics B-l 1 

Aerodynamic Performance B- 1 3 

ENGINE MODEL B-15 

Thrust Function B-15 

Thrust Characteristics B- 1 6 

Thrust Limits B-l 8 

Thrust Lag B-l 9 

AIRPLANE PERFORMANCE B-22 

Performance Envelope B-22 

Cruise Performance B-26 

Airport Performance B-30 

Design Overview B-3 1 

iii 


APPENDIX B 

ELEMENTS OF TRANSPORT AIRCRAFT DESIGN AND OPERATION (continued) 

AIRPLANE OPERATION B-33 

Climb and Descent Operation B-33 

Trajectory Optimization B-35 

Operation Overview B-37 

AIRPLANE DYNAMIC RESPONSE B-38 

Three-Degree-of-Freedom Model B-38 

Simplified Models B-65 

REFERENCES B-71 

LIST OF FIGURES 

Figure B-l. Reference frames B-4 

Figure B-2. Aerodynamic force characteristics B-l 1 

Figure B-3. Variation of corrected thrust with corrected rpm B-I7 

Figure B-4. Variation of maximum thrust with Mach number B-l 8 

Figure B-5(a). Thrust response block diagram B-l 9 

Figure 5(b). Acceleration limit logic B-20 

Figure B-6. Thrust response to throttle steps B-21 

Figure B-7. Performance envelope B-25 

Figure B-8. Variation of payload fraction with range B-30 

Figure B-9. Performance envelope with vertical velocity contours B-34 

Figure B-10. Longitudinal dynamical system B-40 

Figure B-l 1. Elevator step response, 10 sec B-48 

Figure B-l 2. Elevator step response, 60 sec B-51 

Figure B-l 3. Elevator pulse response, 5 sec B-54 

Figure B-l 4. Elevator pulse response, 60 sec B-56 

Figure B-l 5. Elevator pulse response, 1 15 sec, 0 fixed after 4.65 sec, V > Vmin drag B-57 

Figure B-l 6. Elevator pulse response, 2205 sec, y fixed after 2.7 sec, V > Vmin drag B-59 

Figure B-l 7 Elevator pulse response, 1 15 sec, 0 fixed after 4.65 sec, V > Vmin drag B-61 

Figure B-l 8. Elevator pulse response, 885 sec, y fixed after 2.7 sec, V > Vmin drag B-63 

Figure B-l 9. Pitch step response, 5 sec, two degrees of freedom B-66 

Figure B-20. Pitch step response, 1 15 sec, two degrees of freedom B-68 

Figure B-21 . Path step response, 5 sec and long term, single degree of freedom B-70 

LIST OF TABLES 

Table B-l. Transport Aircraft Performance Parameters B-l 2 

Table B-2. Optimal Cruise Altitude B-27 

Table B-3. Transport Aircraft Stability and Control Parameters B-39 

Table B-4. Elevator Step Response B-45 

iv 


APPENDIX C 

SYMMETRIC (COORDINATED) TURNING FLIGHT 


GENERAL VECTOR FORCE EQUATION C-l 

Eulerian Angles for Path frame C-l 

Weight Components C-2 

Kinematic Acceleration Components C-3 

COORDINATED TURNING FLIGHT C-5 

KINEMATIC EQUATIONS FOR COORDINATED TURNING FLIGHT C-6 

Eulerian Angles for Body Frame C-6 

Kinematic Relationships C-7 

Kinematic Approximations C-9 

Limiting Flight Conditions for Transport Aircraft C-10 

Approximation Validity C-l 1 

REFERENCES C-12 

LIST OF FIGURES 

Figure C-L Spatial orientation of path frame C-2 

Figure C-2. Spatial orientation of body frame C-6 

Figure C-3. Orientation of body frame to path frame C-l 


APPENDIX D 

ELEMENTS OF PROPOSITIONAL LOGIC 

ELEMENTARY LOGICAL PROPOSITIONS D-l 

Truth Tables D- 1 

Logical Operations D-3 

Elementary Logical Theorems D-4 

COMPOSITE LOGICAL PROPOSITIONS D-5 

ELEMENTARY THEOREMS IN SYMBOLIC LOGIC D-6 

LOGICAL SIMPLIFICATION OF COMPOSITE PROPOSITIONS D-7 

Simplification of Definition for PE (V) D-7 

Simplification of Definition for PE (y) D-8 

CONDITION-ACTION DECISION TABLES D-9 

Simple Condition-Action Tables D-9 

Mode Selection Tables D-10 

REFERENCES D-12 


v 


APPENDIX D 

ELEMENTS OF PROPOSITIONAL LOGIC (continued) 

LIST OF THEOREMS (AFTER DROMEY) D-13 

Symbols D-13 

Theorems D- 1 3 

LIST OF TABLES 

Table D-l D-9 

Table D-2 D-10 


APPENDIX E 

STATECHART SEMANTICS 

CONVENTIONAL STATECHART SEMANTICS E-l 

State Transition Diagrams E-l 

Hierarchical Statecharts E-2 

Aircraft Implementation E-4 

MODIFICATIONS FOR SEQUENTIAL PROCESSING E-5 

Emulation of Continuous System Elements E-5 

Emulation of Discrete System Elements E-6 

Definition of Time Step E-6 

Violation of Broadcast Synchronization Convention E-9 

Implications for Formal Validation E-9 

A DETAILED IMPLEMENTATION EXAMPLE E-10 

Statechart Example E- 1 0 

Jackson Program Design Example E-l 2 

REFERENCES E-16 

LIST OF FIGURES 

Figure E-l. State transition diagram E-2 

Figure E-2. Hierarchical statechart E-3 

Figure E-3. Real-time operating system E-4 

Figure E-4. Flight control mode selection example E-5 

Figure E-5. Discrete emulation of continuous function E-6 

Figure E-6. Modification of state machine for sequential implementation E-7 

Figure E-7. Jackson Data Structure Chart for mode control example E-l 2 

Figure E-8. Jackson Program Structure Chart for mode control example E-l 3 

vi 


APPENDIX E 

STATECHART SEMANTICS (continued) 


LIST OF TABLES 


Table E-l E-ll 

Table E-2 E-l 5 


APPENDIX F 

THEOREMS ON SYSTEM BEHAVIORAL PROPERTIES 


PROOF METHODOLOGY F-l 

Objectives F-l 

Approach F-2 

Framework of Analysis F-2 

DEFINITIONS F-3 

Logical symbols F-3 

Elementary Theorems F-3 

Symbolic Logical Propositions F-4 

Mode Selection Strategy F-4 

Drag Condition F-5 

Thrust Condition F-5 

Strategy for Setting Target Thrust F-6 

Speed Regulator F-6 

Longitudinal Acceleration Limiter F-7 

Height Regulator F-7 

Definition of Hmax F-7 

Subscripts F-7 

Fixed Speed and Altitude Targets F-7 

V Command Capture Axiom F-8 

V Command Hold Axiom F-8 

PERFORMANCE DEGRADATION F-8 

Lemma A F-8 

Lemma B F-9 

Theorem 1 (Performance Degradation Theorem) F-l 1 


vii 

! 


APPENDIX F 

THEOREMS ON SYSTEM BEHAVIORAL PROPERTIES (continued) 


RECOVERY FROM ABNORMAL CONDITIONS F-l 1 

Lemma C F-l 2 

Lemma D F-l 4 

Initial Conditions for— .PE (y)— .(PE (V) Recovery F-l 5 

Dynamical Analysis F-16 

Theorem 2 (—.PE (y) —.(PE (V) Recovery Theorem) F-l 7 

Proof Automation F-22 

Theorem 3 (PE (y) (PE (V) Recovery Theorem) F-23 

Theorem 4 (—.PE (y) (PE (V) Recovery Theorem) F-25 

EFFECTIVENESS OF ALTITUDE COMMAND SUPERMODE F-26 

Theorem 5 (Altitude Command Supermode Effectiveness Theorem) F-26 

CORRECTION OF A DESIGN OVERSIGHT F-29 

Error Identification F-29 

Strategy for Setting Target Thrust F-29 

Correction of Error F-30 

Discussion F-30 

CONCLUDING REMARKS F-31 

REFERENCES F-31 

LIST OF FIGURES 

Figure F- 1 . Conditions for —.PE (y) —.(PE (V) Recovery F- 1 5 

LIST OF TABLES 

Table F-l. Original Strategy for Setting Target Thrust F-29 

Table F-2. Revised Strategy for Setting Target Thrust F-30 

APPENDIX G 

SELECTED TRANSPORT AIRCRAFT ACCIDENTS AND INCIDENTS 

L-IOI 1, EVERGLADES, 1972 G-l 

B-767, SAN FRANCISCO, LATE 1980s G-l 

B-737, DENVER, EARLY 1990s G-2 

A-330, TOULOUSE, JUNE 1994 G-2 

REFERENCES G-3 

viii 


LIST OF ACRONYMS 


AFS 

Autoflight system 

ATC 

Air traffic control 

CDU 

Control display unit 

EAS 

Equivalent airspeed 

EGT 

Exhaust gas temperature 

EPR 

Exhaust pressure ratio 

FAA 

Federal Aviation Administration 

FMS 

Flight management system 

ILS 

Instrument landing system 

MCP 

Mode control panel 

QSRA 

Quiet short-haul research aircraft 

TAS 

True airspeed 

VNAV 

vertical navigation 


LIST OF SYMBOLS 

English Symbols 


a = a(H) 

3NLIM 

AR = b 2 /S 

b 

C L 

Cdp = Cdp(M) 

dH/dt 

(dH/dt) 0 

dV/dt 

dy/dt 

D 

e = e (M) 

g 

H 

Ho 

AH 


Sonic velocity, ft/sec 

Normal acceleration limit, 3 ft/sec" 

Wing aspect ratio, dimensionless 
Wing span, ft 

Lift coefficient, dimensionless 

Parasite drag coefficient, dimensionless 

Rate of change of height H, ft/sec 

Threshold rate of change of height H, 250 ft/min 

Rate of change of airspeed V, ft/sec 

Rate of change of flightpath angle y, rad/sec 

Drag, lb 

Span efficiency, dimensionless 
Acceleration of gravity, ft/sec' 

Height in Standard Atmosphere, ft 
Altitude deviation threshold, ft 
Altitude error, ft 
Pitch moment of inertia, slug/ft' 


LIST OF SYMBOLS (continued) 


English Symbols (continued) 


K v 

L 

M 

M y 

N 

Po 

q 

s 

T 

T/8 

V 

V u 

W 

w/s 


Longitudinal acceleration limiter parameter, dimensionless 
Lift, lb 

V/a Mach number, dimensionless 

Pitching moment, ft-lb 

Engine rpm (revolutions per minute), percent 
Standard sea-level barometric pressure, 21 16.22 lb/ft 2 
Rate of change of pitch angle 0, rad/sec 
Aircraft wing area, ft 2 
Thrust, lb 

f (N, M) Corrected thrust, lb 

Airspeed, ft/sec 

vVo Equivalent airspeed, ft/sec 

Aircraft weight, lb 
Aircraft wing loading, lb/ft 2 


a 

y 

Ay 

Ypot 

Yspeed 

8sp/p 0 = 5(H) 

Selev 

5j 

0 

po 

o h p/p„ = a (H) 
0 


Greek Symbols 

Angle of attack, rad 

Flightpath angle, rad 

Flightpath angle increment, 3 deg 

Trim (equilibrium) flightpath angle, rad 

Flightpath angle for airspeed control, rad 

Ambient pressure ratio, dimensionless 

Elevator deflection, rad 

Throttle position, rad 

Pitch angle, rad 

Standard sea-level density, 0.00237691 sl/ft 3 
Ambient density ratio, dimensionless 
Bank angle, rad 


x 


LIST OF SYMBOLS (continued) 


Subscripts 


CMD 

EXP 

LIM 

MAX 

MIN 

MC 

PAR 

POT 

REF 

SAFE 

TGT 


Commanded 
Exponential law 
Limited 
Maximum 
Minimum 

Minimum control airspeed 
Parabolic law 

Potential (equilibrium or trim) conditions 
Reference 

Safety envelope limit 
Target 


Logical Symbols 

Equivalence = Negation — ■ 

Logical OR u Logical AND omitted 


Implication 


LIST OF SYMBOLS (continued) 


Logical Conditions 

VT1 = (Vtgt < Vmin) VT2 = (Vtgt > Vmax) 

VT3 = (Vtgt ^ Vmin drag) 


VI = (V < Vmin drag) 

V2 = (V < Vtgt) 

V3 = (V = Vtgt) 

V4 = (V > Vtgt) 


G1 =(y=0) 


GT1 = (Ytgt < Ysafe) 

GT2 = (Ytgt < Ypot tgt) 

GT3 = (Ytgt = Ypot tgt) 

GT4 = (Ytgt > Ypot tgt) 

GT5 = (Ytgt ^ Ypot min) 

GT6 = (Ytgt ^ Ypot max) 

0 = (Ytgt ^ Yspeed min) 

P = (Ytgt ^ Yspeed max) 

DC 1 = (Ypot min < 0) 

PF 1 = (Ypot max = Ypot min) 

o 

V 

X 

< 

g 

III 

U 

H 

TC2 = (Ypot max = 0) 

TS 1 = (y ^ Yspeed min) 

TS2 s (y > Yspeed max) 

TT 1 = (Ypot tgt = Ypot min) 

TT2 = (Ypot tgt = Ypot max) 

TT3 = (Ypot tgt < Ypot min) 

TT4 = (Ypottgt > Ypot max) 

-,PP = (PRIORITY = SPEED) 

PP = (PRIORITY = PATH) 

PE (V) = -! [P TT 1 ] -i [Q TT2] 

PE (y) = — i (GT6 VI TS2) 

H 1 = (Htgt < Hsafe) 

H2 = (Hjgt > Umax) 


NEls-> [(GT2 u GT3) V4] [GT2 V3] 
NE2 b [(GT32 u GT4) V2] [GT4 V3] 

xii 


APPENDIX A 

THE STANDARD ATMOSPHERE 


The aerodynamic and propulsive forces acting on an aircraft depend on the local pressure, tempera- 
ture, density, and sonic velocity that prevail within the atmosphere in the region where the aircraft 
operates. It is the purpose of the standard atmosphere to define representative values of these 
properties as functions of altitude. It is assumed that the atmosphere is static, and rotates with the 
Earth. For current subsonic transport aircraft, the range of interest extends from the surface to about 
45,000 ft, while supersonic transport aircraft may operate at altitudes up to 70,000 ft. 


BASIC EQUATIONS 

The standard atmosphere (Anonymous, 1962) is defined by three basic equations. The hydrostatic 
equation 


dp = - p g dH (A-l) 

relates, in differential form, the pressure p and the density p to the height H, where g is the gravita- 
tional acceleration. The equation of state for air as a perfect gas 

p = p R T (A-2) 

relates the pressure p and the density p to the temperature T, where R is the gas constant for air. The 
third equation specifies the temperature variation with height, separating the atmosphere into two 
regions within the altitude range of interest. 

Troposphere 

The lower region, which is termed the troposphere, extends from the surface to an upper limit 
termed the tropopause at 1 1 km, or 36,089 ft above the Earth's surface. Within the troposphere, the 
temperature decreases linearly with height according to the equation 

T t =T () + LH 0<H<H t (A-3a) 

where the parameter L = dT/dH is termed the temperature lapse rate. To is the standard sea-level 
temperature, and Ht is the tropopause height of 1 1 km. 

Stratosphere 

Above the troposphere lies an isothermal layer termed the stratosphere, within which the tempera- 
ture remains constant at the tropopause value 

T s =T () + LH t H>H t (A-3b) 


A-l 


The sonic velocity a is related to temperature by the thermodynamic equation 


a = V(YRT) (A-4) 

where y is the ratio of specific heats for air. Therefore, the sonic velocity is constant throughout the 
stratosphere. 


DEFINING PROPERTIES AND CONSTANTS 


Primary Constants 

The following parameters are taken as primary constants (Anonymous, 1962), with the values in 
metric (SI) units regarded as the defining values: 

g Gravitational acceleration at the Earth’s surface at 45-deg latitude, 

9.80665 m/sec 2 = 32.17405 ft/sec 2 

R Gas constant for air, 

287.053 joules/kg-deg K = 1716.551 ft-lb/sl-deg R 

y Ratio of specific heats for air, 1 .40 (dimensionless) 


Defining Properties 

The following parameters are taken as defining properties for the standard atmosphere: 

Hj Height of tropopause, 1 1 km = 36,089.2 ft 

L Temperature lapse rate dT/dH, 

-6.5 deg K per km = -0.00356616 deg R per ft 

Pp () Standard sea-level pressure, 1 0 1 325 n/nr = 211 6.22 lb/ft 2 

(76 cm Hg = 29.92 1 3 in Hg at temperature To = 1 4.6960 lb/in') 

T 0 Standard sea-level temperature, 288. 1 5 deg K = 5 1 8.67 deg R 
( 1 5 deg C = 59 deg F) 


Derived Quantities 

The following parameters are derived from equations (A-2) and (A-4): 

a 0 Standard sea-level sonic velocity, 340.294 m/sec = 1 1 16.45 ft/sec 

p„ Standard sea-level density, 1.22500 kg/m' = 0.00237691 sl/ft 3 
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DEFINING EQUATIONS FOR THE TROPOSPHERE 


It will be convenient to normalize the temperature within the troposphere by dividing equation 
(A-3a) by the standard sea-level temperature To, defining the dimensionless ratio 0: 

0 = T/T = 1 + L H/T 0 < H < H t (A-5) 


Eliminating p from equation (A-l) with the help of equation (A-2), and eliminating T with the help 
of equation (A- 3a), the hydrostatic equation (A-l) can be put in the form 


dp _ g dH 
~p~~ R T+LH 

which (neglecting the slight decrease of gravitational acceleration with height) can be integrated 
upward from the surface to obtain 


In 


P _ 


LR 


In 


1 +■ 


H 

V L 


0 < H < H„ 


(A-6) 


Defining the normalized pressure by 8 = p/po and taking anti-logarithms, equation (A-6) becomes 


8 = — = 

Po 


1 + 


H 
T/ L 


-g/LR 


0 < H < H 


(A-6a) 


Similarly defining the normalized density by a s p/p 0 , the equation of state (A-2) takes the normal- 
ized form 8 = a 0, so that, making use of equation (A-6a), the normalized density is found to be 


o = - = 0-< l+ g /LR * = 

0 ' 


1 +• 


H 


x-n + g/LR) 


V L 


0 < H < H 


(A-7) 


The normalized sonic velocity p = a/ao is found from equation (A-4): 


\l = — = V0=J(1 + LH/T) 

a o y 


0 < H < H ( 


(A-8) 
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DEFINING EQUATIONS FOR THE STRATOSPHERE 


Eliminating p with the help of equation (A-2), the hydrostatic equation (A- 1 ) can be put in the form 

— = — — dH 

P RT S 


which, since the temperature Ts is constant in the stratosphere (equation (A-3b)), can be integrated 
upward from the tropopause to obtain 



H -H. 


RT s /g 


H > H 

T 


(A-9) 


In the normalized form, equation (A-9) becomes 

' H-H. 

6 = 5 t exp 


R ygj 


H>H t 


(A-9a) 


where denotes the normalized pressure at the tropopause. The normalized temperature, density, 
and sonic velocity in the stratosphere are given by the equations 


T s H t 

e = — = 1 + — — 

T T /L 


s 


H > H_ 


(A-10) 


8 S x 

o = — = — exp 

e e s 


H-H/ 

R V« , 


H >H. 


(A- 1 1) 




(A- 12) 


STANDARD ATMOSPHERE TABLE 


Numerical Constants 

Numerical evaluation of the constants in equations (A- 1 ) to (A- 12) results in the following values 
for English units: 


o 

L 


518.67 deg R 


0.00356616 deg R/ft 


= - 145,442 ft 


A-4 


32.17405 ft /sec - 


LR (-0.003566 16 deg R / ft) ( 1 7 1 6.55 1 ft-lb/sl-deg R) 
= 5.255913 (dimensionless) 


T =518.67 deg R + (-0.00356616 deg R/ft) (36,089.2 ft) 


= 389.97 deg R 


8 t = 


36,089,2 ft 
145,442 ft 


5.255 913 


= 0.223 359 (dimensionless) 


RT s = (1716.551 ft-lb/sl-deg R) (389.97 deg R) _ 8Q5 ? ft 

g 32. 1 7405 ft/sec/sec 


Numerical Equations 

With these numerical values, the equations for the normalized quantities become 


0 = 1 — 


Hu 


145.442 


0 < H < Ht 


rp 

0 = 0s = — = 0.75 1 865 
T 


H > Ht 


5 = 


1 - 


Hr. 


\ 


5.255 913 


145.442 


0 < H < Ht 


6 = 0.223 359 exp 


Hu - 36.089.2 ^ 
20.805.7 


H > Ht 


a = 


Hr. 
145.442 




4.255 913 


0 < H < Ht 


a =0.297 073 exp 


Hr. - 36.089.2 ' 
20.805.7 } 


H> Ht 


p=V(l-Hr./145,422) 0<H<Ht 

H s =^ = 0.867107 H > Ht 


(A-5) 
(A- 10) 

(A-6a) 

(A-9a) 

(A-7) 

(A-ll) 

(A-8) 
(A- 12) 
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Tabulated Values 

Evaluation of these equations for several selected altitudes between the surface and 45,000 ft results 
in the following tabulated values. Comparison with the reference document (Anonymous, 1962) 
shows agreement within 5 units in the last place. 


STANDARD ATMOSPHERE TABLE FOR SIX SELECTED ALTITUDES 


Sea-Level Properties 

H, ft 

T„, deg R 

p«, Ib/ft 2 

Po, sl/ft 3 

a<), ft/sec 

0 

518.67 

2116.22 

0.00237 691 

1 1 16.45 

Dimensionless Ratios 


0 = T/T 0 

On 

III 

d. 

a. 

Ill 

b 

'cS 

III 

3. 

5,000 

0.965 622 

0.832 047 

0.861 669 

0.982 661 

10,000 

0.93 1 244 

0.687 702 

0.738 447 

0.965 010 

15,000 

0.896 866 

0.564 339 

0.629 235 

0.947 030 

25,000 

0.828 110 

0.371 089 

0.448 116 

0.910 006 

35,000 

0.759 354 

0.235 302 

0.309 872 

0.871 409 

45,000 

0.751 865 

0.145 546 

0.193 580 

0.867 101 


REFERENCES 

Anonymous: U. S. Standard Atmosphere, 1962. National Aeronautics and Space Administration, 
United States Air Force, and United States Weather Bureau. U.S. Government Printing Office, 
Washington, D.C., Dec. 1962. 
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APPENDIX B 

ELEMENTS OF TRANSPORT AIRCRAFT DESIGN AND OPERATION 


INTRODUCTION 

The purpose of this appendix is to present a concise, tutorial overview of transport aircraft design 
and operation for readers without this background. In particular, the review of aircraft dynamic 
response presented in the final section of this appendix supports the discussion of dynamical system 
properties in the main report. The treatment is at the level of an introductory course, starting from 
elementary principles and using simplifying assumptions commonly used within the aircraft industry 
during preliminary design. Readers desiring more detail can consult the references provided. 

Only the longitudinal motions of the aircraft within its plane of symmetry are treated by this appen- 
dix, but these motions provide the basis for discussing aircraft performance and other reference 
material needed for the main report. A nonelementary generalization of the longitudinal equations 
for coordinated turning flight is presented in appendix C. 

The plan of presentation for this appendix is as follows. After discussing simplified models for the 
Earth, the atmospheric environment, and the aircraft structure, the three longitudinal equations of 
motion for flight in still air are derived from Newton’s second law. A brief discussion then shows 
how those equations can be generalized to include the effects of wind and wind shear. The motion of 
the aircraft is subject to aerodynamic and propulsive forces, which are analyzed next. 

For simplicity, aerodynamic forces are discussed entirely from the experimental viewpoint, avoiding 
the complexities of aerodynamic theory. Dimensional analysis is used to simplify experimental 
results by identifying the nondimensional combinations of parameters that constitute Reynolds num- 
ber, Mach number, and the aerodynamic force coefficients. Dynamic similarity based on these 
nondimensional parameters enables the aerodynamic forces acting on full-scale aircraft to be pre- 
dicted from the results of model tests. Aircraft lift and drag characteristics are presented, and a 
generic aerodynamic model representative of large transport aircraft is developed. 

Propulsive thrust is treated from an experimental viewpoint similar to that for aerodynamic forces. 
Dimensional analysis provides the basis for correlating engine manufacturers’ data gathered under 
various altitude and temperature conditions, and a generic engine model is developed based on 
NASA simulation models that is representative of the high-bypass-ratio turbofan engines installed 
on current transport aircraft. The dynamic response of the engine to throttle control is specified in 
block-diagram form. 

The steady-state solution of the longitudinal equations of motion is then used to define the perform- 
ance envelope of the aircraft. The selection of operating points within this envelope that optimize 
performance is discussed. The Breguet range equation is derived, and a representative payload-vs- 
range diagram is constructed to show primary economic influences on design. Brief comments on 
airport performance show the influence of wing loading and thrust loading as design parameters. 
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The selection of operating points for climb and descent is described, and the performance discussion 
concludes with some comments on trajectory optimization for complete mission profiles. 

In the final section, the dynamic response of the generic airplane to control is treated in some detail, 
and simulation models are developed at three levels of dynamical fidelity. Simulation equations and 
block diagrams are provided, and numerical simulation techniques are illustrated by using a widely 
available spread-sheet package, enabling interested readers to perform their own dynamic response 
calculations. In addition to providing results needed for the main report, it is hoped that such simu- 
lations may aid readers, especially those with flying experience, to gain an improved grasp of 
transport aircraft dynamic response characteristics without requiring a detailed mathematical under- 
standing of the nonlinear differential equations on which those response characteristics depend. 


LONGITUDINAL EQUATIONS OF MOTION 

The equations of motion for transport aircraft are obtained by application of Newton’s second law to 
a rigid aircraft subject to aerodynamic, propulsion, and gravitational forces. Six ordinary differential 
equations result, three scalar force equations and three scalar moment equations. Because transport 
aircraft are bilaterally symmetric and operate in symmetric (coordinated) flight with near-zero side- 
slip angles, the six equations of motion are decoupled to form a longitudinal set describing motions 
in the plane of symmetry, and a lateral-directional set describing asymmetric motions. This appendix 
treats only the longitudinal motions. 

Earth Model 

The Earth is represented as flat and nonrotating, with uniform gravity independent of latitude and 
height (local tangent plane approximation). This simplified Earth model neglects the very small 
contributions from Coriolis force encountered in great-circle flight over a rotating Earth, and from 
centrifugal “weightlessness” force encountered in flight over a spherical Earth at high speeds 
approaching orbital velocity, neither of which is of interest for control of subsonic transport aircraft. 

Atmospheric Environment 

For flight in still air, the atmospheric environment is completely specified by the properties of the 
standard atmosphere, which describes the variations with altitude of ambient pressure, temperature, 
density, and sonic velocity (app. A). After discussing the equations of motion for flight in still air, it 
is shown how these equations can be generalized to include the effects of steady wind and those of 
wind shear. The effects of atmospheric turbulence, which are usually studied by simulation employ- 
ing suitably filtered random noise, are not treated here. 

Aircraft Structural Model 

Transport aircraft are not structurally rigid, but the natural frequencies of their structural modes 
usually lie far above the frequencies of concern for control, justifying the approximation that elastic 
structural deformations can be considered to take place instantaneously. This quasi-static approxima- 
tion enables the airflow to be represented as acting on the deformed aircraft. The gyroscopic effects 
of rotating engine machinery are omitted, and the control surfaces of the aircraft are assumed to be 
actuated irreversibly, so that they involve no additional degrees of freedom. 


B-2 


Reference Frames 

The frame of reference in which the aircraft motions are described could be taken as fixed in the 
Earth, which under our assumptions is an inertial (unaccelerated) frame in which the Newtonian 
equations are directly valid. Alternatively, the motion of the aircraft with respect to the Earth can be 
described in a reference frame fixed in the aircraft itself (the body frame), with its origin located at 
the aircraft center of mass and its three orthogonal axes aligned with the aircraft fuselage and wing 
structure (fig. B-l(a)). It is essential to describe the aircraft rotational motions in the body frame to 
avoid the appearance of the moments and products of inertia in the equations of motion as time- 
varying parameters. 

For the translational motions of the aircraft, this report uses the path frame, which by definition is 
fixed in the aircraft with its origin at the aircraft center of mass like that of the body frame, but with 
one of its three orthogonal axes aligned with the aircraft velocity vector, and the other two normal to 
it, as illustrated by figure B-l(b). Both the body-frame and path-frame descriptions include acceler- 
ation cross-product terms that account for rotation of the reference frame with respect to the Earth. 

For wings-level flight, the orientation of the body frame relative to the Earth is specified by the pitch 
angle 0 (fig. B-l(a)), and the orientation of the path frame relative to the Earth is specified by the 
flightpath angle y (fig. B-l(b)). In still air, the angle of the body-frame longitudinal axis relative to 
the airstream, which is termed the fuselage angle of attack (fig. B-l(b)), is given by the equation 

a = 0-y (B-l) 


where the notation is 

a Fuselage angle of attack, rad 0 Pitch angle, rad 

y Flightpath angle, rad 

Choice of the path frame for the translational motions is convenient from two viewpoints. First, the 
force description is simplified because, by definition, the aerodynamic streamwise (drag) force and 
the normal (lift) force are aligned with the axes of the path frame (fig. B-l(c)). Furthermore, normal 
forces contributed by the propulsion system (that is, powered lift owing to thrust inclination) are 
small in conventional transport aircraft and can be neglected, together with forces resulting from 
interaction of engine efflux with aerodynamic flow. Therefore, both the aerodynamic forces and the 
thrust are aligned with the path-frame axes, so that only the gravitational force requires trigonomet- 
ric transformation. 

Second, from the human-factors perspective, the pilot's primary control task can be regarded as the 
moment-to-moment control of the aircraft velocity vector in such a way as to realize the mission 
objectives summarized by the flight plan. During manual control, the pilot’s task is facilitated by 
providing separate control of each of the three components of the velocity vector (that is the 
directional track angle, the flightpath angle, and the airspeed), and by eliminating dynamical 
coupling between these elements. The parameterization resulting from choice of the path frame 
contributes to these design objectives. 
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a) Earth frame and body 
frame. 



b) Path frame aligned with 
velocity vector. 

Figure B-1. Reference frames. 


c) Force equilibrium. 


Equations of Motion 

Under the assumptions just discussed, the longitudinal motions of the aircraft can be described by 
the following three scalar equations (fig. B-l(c)), which result directly from application of Newton’s 
second law to a rigid aircraft subject to aerodynamic, propulsive, and gravitational forces, and are 
valid during straight (nontuming) flight in still air: 


Longitudinal force equation: 
Normal force equation: 

Pitching moment equation: 
where the notation is as follows: 


ma_=T-D-W sin y 

T 1 IN 

m a = L - W cosy, 

N * * 


'IN 




English symbols 


(B-1 a) 
(B-lb) 

(B-lc) 


aj 

Tangential acceleration, ft/sec : 

m 

Aircraft mass, slug 

aN 

Normal acceleration, ft/sec" 

M y 

Pitching moment, ft-lb 

D 

Drag, lb 

q 

Pitch rate, rad/sec 

g 

Gravitational acceleration, 32.1741 ft/sec“ 

T 

Thrust, lb 

Iy 

Pitching moment of inertia, slug-ft" 

V , N 

Tangential acceleration, ft/sec 

L 

Lift, lb 

w 

Aircraft weight, lb 


Greek symbols 


yiN Inertial flightpath angle, rad 


The kinematic acceleration aj in the direction of the velocity vector is equal to dV^/dt, and the 
normal (centripetal) acceleration a N toward the instantaneous center of rotation is given by the cross- 
product V in (dyiN/dt). Furthermore, the aircraft mass m is equal to W/g. Making these substitutions. 
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and dividing the two force equations by the weight W, the longitudinal equations can be put in the 
form 


1 dV |N _ T - D 
g dt W 


- sin 


'IN 


(B-2a) 


V dy 

IN * IN 

g dt 


L 

cos 

W 


'IN 


(B-2b) 



(B-2c) 


A formal derivation of these equations using vector methods is presented in appendix C, which gen- 
eralizes the equations for coordinated turning flight. It should be noted that, in still air, the airspeed 
V coincides with the inertial velocity Vin, and the flightpath angle y relative to the airmass coincides 
with the inertial flightpath angle yiN- 

Wind and Wind Shear 

For a steady tailwind acting in the streamwise direction along the velocity vector, the airmass moves 
uniformly with respect to the Earth, so that the airspeed V is related to the inertial velocity V IN by 
the Galilean transformation 


V[N = V + w 


(B-3a) 


where the notation is as follows: 


V Airspeed, ft/sec w Tailwind component of wind velocity, ft/sec 

Because the tailwind is assumed to act in the streamwise direction, the flightpath angle y relative to 
the airmass continues to coincide with the inertial flightpath angle y^- It can be seen that the sub- 
stitution of equation (B-3a) into equation (B-2a) does not produce additional terms, since the time 
derivative of the tailwind w vanishes for a steady wind. 

If the airmass accelerates instead of moving uniformly, or if the wind field varies with altitude so 
that the aircraft encounters changing winds during climb or descent, then substitution of equation 
(B-3a) into equation (B-2a) causes an additional term involving the wind shear dw/dt to appear in 
the longitudinal (streamwise) force equation: 


1 dV T - D 1 dw 

= sin y 

g dt W IN g dt 


(B-3b) 


In an increasing tailwind, the wind shear term (1/g) dw/dt on the right side of equation (B-2a) acts to 
reduce airspeed in the same way as a drag increase or a thrust reduction. Since the lift L in equation 
(B-2b) is proportional to the square of airspeed, the loss of lift owing to reduced airspeed results in 
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downward acceleration, causing the aircraft to settle below its still-air path. Aircraft performance 
can be severely degraded. Steady downdrafts have a similar performance-degrading effect on the 
aircraft even though the airmass moves uniformly, because level flight relative to the Earth requires 
climbing flight relative to the airmass. 

In general, for flight in steady horizontal wind and steady vertical draft, the longitudinal equations 
of motion remain unchanged in form, provided that the speed and flightpath angle are measured 
relative to the airmass. The aerodynamic lift and drag forces and the thrust force are, of course, 
referred to the airmass by their definitions. These forces will be examined in detail in the following 
sections. 


AERODYNAMIC FORCES 
Similarity in Fluid Mechanics 

The fluid forces acting on a submerged body such as an aircraft are related to the size and shape of 
the body, its motion relative to the fluid, and to the physical properties of the fluid by a general 
functional relation of the form 

f (force, size, shape, motion, fluid properties) = 0 


Size and Shape 

Body size can be represented by a characteristic length such as the wing span of an aircraft or its 
fuselage diameter. Its shape can be represented by dimensionless ratios such as the thickness/chord 
ratio that characterizes an airfoil section. In addition to the geometric shape factors that remain fixed 
for a given body, shape also involves the angle of attack of the body relative to the fluid flow, which 
is defined by the angle between the velocity vector and a longitudinal reference axis fixed in the 
body, such as the fuselage floor of an aircraft (fig. B-l). 

Motion 

In general, the motion of the body involves both its velocity and its acceleration relative to the fluid. 
In steady motion the acceleration vanishes, and the forces depend only on the velocity of the body 
relative to the fluid. If an aircraft maneuvers, the necessary force is generated by changes in the 
aerodynamic pressures acting on its surfaces. In subsonic flight, these pressure changes are propaga- 
ted throughout the flow field near the aircraft, and produce changes in the flow pattern that modify 
the forces acting on the aircraft. Therefore, the total force depends in general (that is, in unsteady 
flow) on the acceleration of the fluid as well as on its relative velocity. 

However, if the aircraft maneuvers slowly enough, the resulting flow-pattern changes can be regard- 
ed as taking place instantaneously relative to the velocity changes of the aircraft, so that the aerody- 
namic forces depend only on the relative velocity of the fluid, and not on its acceleration. This 
approximation, termed quasi-steady flow, is justified for transport aircraft by their limited maneu- 
vering capability. 
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Fluid Properties 

The fundamental properties of a fluid that influence the forces acting on a submerged body are its 
density, which influences inertia force, its viscosity, which influences fluid friction (shear) force, 
and its compressibility, which influences elastic force. The compressibility of a fluid can be speci- 
fied by giving the value of sonic velocity. Gravity is not involved, because the buoyancy force 
resulting from gravity acts on a submerged body independently of its motion. 

Functional Relation 

Accounting for size, shape, motion, and fluid properties, the aerodynamic forces acting on transport 
aircraft can be expressed symbolically by the following functional equation: 

f (F, 1, V, p, d, a, a, body shape) = 0 (B-4) 

where the notation is as follows: 

F force, lb p density, slug/ft 3 

1 characteristic length, ft U viscosity, slug/ft-sec 

V relative velocity, ft/sec a sonic speed, ft/sec 

a angle of attack, rad 

The nature of this functional relationship can be clarified by dimensional analysis, which enables the 
functional dependence of the aerodynamic force to be expressed in nondimensional form. 

Dimensional Analysis 

The Buckingham k theorem asserts that any function of r dimensional variables involving s funda- 
mental quantities can be reduced to a function of (r - s) dimensionless groups (Bridgman, 1970; 
Taylor, 1974). Since there are six unknown dimensional variables involving the three fundamental 
quantities mass, length, and time in equation (B-4), it follows from the theorem that the functional 
relation can be expressed in terms of three unknown dimensionless groups in the following way: 

f (7C|, 7 i:, K), oc, body shape) = 0 (B-4a) 

where each of the three dimensionless groups Jt|, Ji:, JI 3 consists of a product of the dimensional 
variables with unknown exponents. 

In general, each group involves all except one of the dimensional variables. The choice of the vari- 
ables in each group is arbitrary, but can be guided by heuristic knowledge. Since it is desired to find 
the functional variation of the force F, it is included only in the first group Tti to permit its later iso- 
lation. Since the force is known experimentally to depend weakly on the viscosity, the latter is 
omitted from the first group in order to separate it from the force. 

Thus the variables chosen for the first group K\ are F, V, p, 1, and a. Denoting their unknown expo- 
nents by the symbols i, j, k, and n, dimensional homogeneity requires that the dimension of the 
product (F V' p' l k a n ) must vanish. In terms of the fundamental physical quantities mass M, length L, 
and time T, the dimensions of the quantities appearing in this product are as follows: 
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MI L 1 M 1 L n 

Dim F = __il Dim V' =— Dimp'=^- Dima = — 

y- yl ' rpn 

By substituting these dimensions into the first product, the following dimensional equation is 
obtained: 


ML _U JVfi L k J^_ = M o L o T o 
T” t* j n 


(B-4b) 


Collecting terms and equating exponents in equation (B-4b) results in the following system of linear 
equations in the unknown exponents: 


l+j = 0 l + i + k + n-3j = 0 2 + i + n = 0 


(B-4c) 


There are three equations in the four unknown exponents i, j, k, and n. Solving for i, j, and k in terms 
of n results in the solution 


i = -1 - i 


j=-l 


k = -2 


With these exponents, the 7t| product becomes 


(F V -2-n p-' P 2 a n ) = -4^(^)' 

pV 2 l 2 V 


(B-4d) 


Since both the factors F/pV 2 l 2 and a/V are nondimensional, they correspond to the 7t| and K 2 groups. 

Removing both of the variables F and a from the third dimensionless product 713, it becomes 
(V 1 p J l k \) m ). The dimensions of the quantities appearing in this product are 


I ' M ' . . M m 

Dim V 1 = — - Dimp 1 =— r- Dim l k = L k Dim u" 1 = 

T‘ L 3j L T 


(B-4e) 


Solving the dimensional equation in the manner just illustrated to obtain the exponents i, j, and k in 
terms of m, the 713 product is found to be 


( V -m p-m j-m = 


V ' 


pvi j 


(B-4f) 


Defining the dimensionless quantities 7t|, K 2 , and 713 to be 

C,.=2F/pV 2 l 2 M = V / a Re s p V \/v 


(B-5) 
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the functional relation (B-4a) becomes 


f (Cf, a, M, Re, body shape) = 0 (B-6a) 

Equation (B-6a) can be solved for Cf to obtain the nondimensional force equation 

Cf = g (oc, M, Re, body shape) (B-6b) 

in which the form of the function g is entirely unrestricted by the dimensional analysis. 

Force Coefficient 

The nondimensional quantity Cf = 2 F/p V“ 1 is termed the coefficient of the aerodynamic force F. 
The quantity 1 2 represents a characteristic area that is taken as the frontal area for bodies such as 
fuselages and as the wing planform area S for wings and for complete airplanes. The important 
quantity p V~/2, which is termed the dynamic pressure, corresponds to the kinetic energy of a unit 
volume of air moving at velocity V. The factor of 2 is introduced for convenience without changing 
the nondimensional nature of the force coefficient. 

Mach Number 

The quantity M = V/a is termed the Mach number. It represents the ratio of the inertia force acting 
on a fluid element to the elastic force resulting from the compressibility of the fluid. For flight at 
Mach numbers less than about 0.3, air can be considered “incompressible”; that is, its density is 
nearly constant in fluid flow. At such low Mach numbers, elastic forces are unimportant, so that the 
Mach number can be dropped from the functional relation B-6(b). 

Reynolds Number 

The quantity Re = pVl/u is termed the Reynolds number. It represents the ratio of the inertia force 
acting on a fluid element to the viscous force. At sufficiently large Reynolds numbers, it is found 
experimentally that the force coefficient depends weakly on Reynolds number, which can therefore 
be dropped from the functional relation. It is not that viscous effects are unimportant at high 
Reynolds number, but that they become insensitive to changes in Reynolds number at the large 
values characterizing flight of transport aircraft. 

Force Equation 

For a given aircraft of known wing, tail, and fuselage shape, the aircraft shape factor is constant and 
can also be dropped. By combining the definition of force coefficient with the functional relation 
(B-6b) and dropping the Reynolds number and body shape factors as just discussed, the force equa- 
tion is finally obtained in the form 



)SC H (a. M) 


(B-6c) 
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The primary airplane force coefficients used in this report are the lift coefficient C L and the drag 
coefficient C D , which are defined by specializing equation (B-6c): 


\/2 y 2 

L = (£^-)SC l (<x,M) D = (^-)SC d («,M) 


(B-6d) 


Moment Equation 

Aerodynamic moments acting on an aircraft result from the distribution of aerodynamic forces over 
the aircraft surface. By carrying out a similar dimensional analysis with the pitch rate q included as a 
separate motion variable, it can be shown that the pitching moment My (equation (B-2c)) can be 
expressed in the nondimensional form 

M y =(£^1 )ScC m (a,qL T /V,M,8 E ,6 ST J (B-6e) 

where c is the wing chord and Cm is termed the pitching moment coefficient. The elevator deflection 
5 e provides pitch control, and the stabilizer deflection 5stab provides the pitching moment required 
for pitch equilibrium (trim) with the elevator faired (5e = 0). The pitch rate has been expressed 
nondimensionally by multiplying it by the tail arm Lr and dividing by the airspeed V. This nondi- 
mensional pitch rate corresponds to the change in angle of attack at the horizontal tailplane, which 
contributes most of the damping in pitch. For simplicity, pitching moment contributions owing to 
thrust are omitted from equation (B-6e). 

Dynamic Pressure 

An alternate form of the dynamic pressure p V 2 /2 can be obtained as follows. Substitute the relation 
p = p/RT from the equation of state, where p denotes the ambient pressure, T the ambient tempera- 
ture, and R the gas constant (app. A). Then substitute V = M a from equation (B-5) to obtain the 
relation 





2 

a“ 


In a compressible fluid, the sonic speed a is given by the relation a 2 = ysRT (app. A), where ys 
denotes the specific heat ratio (ys = 1 .40 for air). With this, the dynamic pressure becomes 



(B-6f) 


This result could have been obtained directly from the dimensional analysis by choosing pressure 
and temperature as fluid properties instead of density and sonic velocity. 
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Dynamic Similarity 

Because the Mach number and Reynolds number together determine the force ratios acting on each 
fluid element, they determine the streamline pattern of the flow around a body such as an aircraft. If 
a model having the same shape as an aircraft is placed in a wind tunnel far from the tunnel walls and 
tested at the same angle of attack, Mach number, and Reynolds number as those prevailing for the 
aircraft in flight, the streamline pattern of the flow around the model will be geometrically similar to 
that of the flow around the aircraft. The lift and drag coefficients measured for the model will then 
be identical to those for the aircraft (equation B-6b). 

This condition of dynamic similarity provides the basis for scaling up the forces measured during 
model testing to estimate those acting on the aircraft in flight. The economy of effort resulting from 
use of the nondimensional functional relation (B-6a) instead of the dimensional form (B-4) is 
impressive. A similar economy of description results from use of the nondimensional parameters in 
dynamical modeling and simulation. 

Aerodynamic Force Characteristics 

The functional forms of the lift and drag coefficients for representative transport aircraft are illus- 
trated by figure B-2, which shows the variations of these coefficients with angle of attack and Mach 
number. 



a) Lift curve b) Drag polar 

Figure B-2. Aerodynamic force characteristics. 
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Lift 

It can be seen that the variation of lift coefficient with angle of attack is nearly linear for angles of 
attack below the stalling angle, which decreases with increasing Mach number (fig. B-2(a)). There- 
fore, it can be represented by an equation of the form 


C L = (dCL/da) (a - ao) (B-7a) 

where oto denotes the angle of zero lift, and the lift-curve slope dCt/dcc depends on Mach number. 
The lift-curve slope can be approximated for transport aircraft by the equation (Shevel 1, 1989) 


dC L 2k AR 

da 2+1.03 AR y[(\ + tan 2 A-M 2 ) 


(B-7b) 


where A is the angle of wing sweep and AR is the wing aspect ratio defined in the next section. 
Equation (B-7a) is valid for angles of attack less than the stalling angle, for which the lift coefficient 
takes on its maximum value Cl max (fig- B-2(a)). Representative parameter values for transport air- 
craft can be found in table B- 1 . 


TABLE B-1. TRANSPORT AIRCRAFT PERFORMANCE PARAMETERS 


M <, 0.6 Wing flaps and landing gear retracted 



Cl max - 1-30 
Cl min drag = 0-53 

C D p = 0.0150 AR = 7.2 e = 0.83 

(L/D)max= 17.7 V e max = 400 kt 



Maximum 

Midcruise 

Maximum 

Normal 


takeoff 

weight 

landing 

landing 


weight 


weight 

weight 

W/S, lb/ft 2 

150 

125 

110 

90 

T/W (static) 

0.25 

0.30 

0.34 

0.42 

V E STALL; Lt 

184.6 

168.5 

158.1 

143.0 

V E MIN DRAG; kt 

289.0 

263.9 

247.5 

223.9 


Drag 

The variation of drag coefficient with lift coefficient is approximately parabolic over the range used 
in airline service (fig. B-2(b)). Therefore, it can be represented by an equation of the form 


C. 

C =C + — 

D I)P K AR e 


(B-7c) 
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where Cdp and e depend on the Mach number for M > 0.6 (fig. B-2(b)). The parasite drag represent- 
ed by Cdp is due primarily to skin-friction drag independent of lift. 

The second right-hand term of equation (B-7c) represents lift-dependent drag termed induced drag, 
which corresponds to the rate of increase of kinetic energy in the trailing vortices that form in the 
wake of the aircraft. The dimensionless aspect ratio AR is defined by AR = bVS, where b is the wing 
span and S the wing area. The Oswald span efficiency factor e accounts for the differences between 
practical wings and a hypothetical wing of the same span with elliptic spanwise distribution of lift, 
for which induced drag is known theoretically to be minimum and the efficiency factor e to be unity. 
Representative values of AR and e for transport aircraft can be found in table B-l . 

Aerodynamic Performance 

The aircraft lift and drag characteristics determine several parameters that are important for aerody- 
namic performance. 

Level-Flight Performance 

For steady level flight (dV/dt = dy/dt = 0), equation (B-2a) shows that the thrust T must equal the 
drag D. Similarly, equation (B-2b) shows that the lift L must equal the weight W. Expressing the 
lift in coefficient form (eq. (B-6d)) and using the alternate form for the dynamic pressure f 
(eq. (B-6f)), the lift equation for steady level flight can be put in the form 

L = (y s pM : /2)SC L = W (B-7d) 

Solving this equation for M and expressing the atmospheric pressure p in the nondimensional form 
8 Po (eqs. (A-6a), (A-9a)), the Mach number required for steady level flight is found to be 


, / w/S 

M=^(2/y s p) (W/S) (1/C L ) = J(2/y s p„)(— )(1/C L ) (B-7e) 

The important parameter W/S is termed the wing loading. Physically, the wing loading represents 
the weight supported by each unit area of wing surface. Representative parameter values can be 
found in table B-l. Similarly, by expressing the dynamic pressure^ as pV : /2 and solving the lift 
equation for the airspeed V, the airspeed required for steady level flight is found to be 

V = ^(2/p) (W/S) (1/C L ) = ^(2/p () ) (W/S/o) (1/C ( ) (B-7f) 


Stall 

The stalling airspeed Vstall is found by substituting the maximum lift coefficient into equation 
(B-7 f): 


V STALL=V< 2/ P0>< W/Sto|/C LMAX 


(B-7g) 
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Representative values of the parameters Clmax and Vstall for transport aircraft can be found in 
table B-l . 

Lift/Drag Ratio 

The ratio of lift to drag L/D is an important figure of merit for aerodynamic performance. Since it 
follows from the definitions (B-6d) that this ratio is the same in coefficient form as in dimensional 
form, it can be seen from figure B-2(b) that the point of maximum L/D is determined by the tangent 
line from the origin with smallest slope. The corresponding angle of attack can then be found from 
figure B-2(a). 

In dimensional form, the parasite drag corresponding to the first right-hand term of equation (B-7c) 
is defined from equation (B-6d) to be Dp = (p V : /2) S Cdp, and similarly the level-flight induced 
drag corresponding to the second right-hand term is 

D ( = (p V 2 /2)SC L 2 /7rARe = (p V 2 /2) S [ W/(p V 2 /2) S] 2 /jrARe 
or 

D ( = [(W/S)/(p V 2 /2)] [W/tt AR e] 

Thus Dp is proportional to V“, and D| to 1 / V . Clearly, the total drag D = Dp + Di takes on its mini- 
mum value at some intermediate airspeed that will be termed V M in drag- 

Minimum Drag 

For M < 0.6 where the parasite drag Cdp and the span efficiency e are independent of Mach number, 
this minimizing airspeed could be found by differentiating the total drag D with respect to the air- 
speed V. Alternatively, the lift coefficient corresponding to minimum drag can be found by differ- 
entiating the ratio Cd/Cl obtained from equation (B-7c) with respect to Cl- This minimizing value is 
found to be 


C L MIN DRAG = V<” AR ' C „ P > < B - 7h > 

By analogy to equation (B-7g), the level-flight airspeed for minimum drag is then 

V M,N DRAG = V<2/P„)(W/S/C)/C lm|n „ rao <B-7i) 

Since for steady level flight D = L/(L/D) = W/(L/D), minimizing the total drag D maximizes the 
lift/drag ratio L/D = Cl/Cd- 

By substituting Cl min drag into equation (B-7c), the minimum value of the drag coefficient 
Cd min drag > s found to be 


C D MIN DRAG C DP + 71 AR e C DP /n AR e 2 C DP 


(B-7j) 


B- 14 


Equation (B-7j) shows that, at the speed for minimum drag, the parasite drag and the induced drag 
are equal. Representative values of Cl min drag, Vmin drag, and (L/D)max for transport aircraft can 
be found in table B-l . 

Equivalent Airspeed 

The equivalent airspeed Ve is defined as the product of the true airspeed V and the square root of the 
nondimensional density ratio a s p/p () (app. A), so that equation (B-7f) becomes 

V k = V Va = A /(2/p o )(W/S)/C L (B-7k) 

Expressed in terms of the equivalent airspeed, the stalling speed (equation (B-7g)) becomes 

V = /(2/p )(W/S)/C (B-71) 

E STALL y F 0' V ' L MAX v ’ 

Equation (B-71) shows that, in terms of equivalent airspeed, the stalling speed is independent of 
ambient density, and therefore independent of altitude. The same is true for Vmin drag (eq. (B-7i)). 

By substituting M = V/a, a = ao V0, and o = V(8/0) (app. A) into equation (B-7k), the relation 
between equivalent airspeed and Mach number is found to be 

V H = V yfa - M a [ Vo ] = M a (| V© [yfi&TO) ] = M a () VS (B-7m) 


where ao = 1 1 1 6.45 ft/sec = 66 1 .48 kt. 

Since the dynamic pressure f is defined by pV : /2 = p () gV 72 = p 0 Ve 2 /2, structural loads depend on 
the square of Ve- At low Mach numbers, the equivalent airspeed Ve is approximately the same as 
that measured by the aircraft pitot-static system for display to the pilot. 


ENGINE MODEL 
Thrust Function 

The engine thrust can be regarded as a fluid force acting on a submerged body (that is, the engine 
itself within its nacelle), so that the thrust is related to the size and shape of the engine, its motion, 
and the physical properties of air as its working fluid by a functional relationship of the same kind as 
that for the aircraft itself, as discussed previously. Representing the size by a characteristic length 
that can be taken as the diameter of the inlet, and taking the rotational shaft speed as a separate 
motion variable and pressure, temperature, and viscosity as fluid properties, the thrust can be 
expressed symbolically by the following functional equation: 


f (T, D, V, N, p, T a , u, shape) = 0 


(B-8) 
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where the notation is as follows: 


T Thrust, lb 

D Inlet diameter, ft 

V Airspeed, ft/sec 

N Rotational speed, rev/min (rpm) 


p a Ambient pressure, lb/ft 2 

T a Ambient temperature, deg R 

u Viscosity, slug/ft-sec 


The shape factor can be regarded as a large number of dimensional ratios that, taken together, 
entirely determine the complex internal geometry of the engine, including all its rotating machinery. 
By applying dimensional analysis to equation (B-8), it can be shown (Hill and Peterson, 1992) that 
the thrust can be expressed in nondimensional form by the equation 


pD 2 


= f 


M, 


ND 




, Re, shape 


(B-8a) 


Since the sonic velocity is given by a = VysRT a (equation (A-4), the nondimensional rotational speed 
ND/VysRTa can be regarded as a measure of the Mach number at the tips of the turbine blades. Just 
as for the aerodynamic force functions, it is found that, at the high Reynolds numbers characterizing 
engine operation, the thrust is nearly independent of the Reynolds number Re, which can therefore 
be dropped from the functional equation. 

For a given engine, the inlet diameter D and the shape factors are fixed constants that can also be 
removed from the functional equation. Introducing the dimensionless pressure and temperature 
ratios 6 = p/p () and 9 = T a /To (app. A), the thrust can be expressed by the equation 


T 

6 


N N 
M, —j= 

Ve 


(B-8b) 


where the standard sea-level values of pressure and temperature p 0 and T 0 have been removed. 
Equation (B-8b) is useful for correlating engine manufacturers’ data gathered under various condi- 
tions in flight with the static thrust measured under standard sea-level conditions. The quantity T/8 is 
termed the corrected thrust, and the quantity N/V0 is termed the corrected rpm. 

Thrust Characteristics 

Turbofan engines are characterized by their bypass ratio, which is the ratio of the mass airflow 
passing through the fan to that passing through the core engine. Bypass ratios of 5 to 6 are represen- 
tative of the engines in use on current transport aircraft. The variation of corrected thrust with cor- 
rected rpm typical of such engines during steady-state operation under static conditions (M = 0) is 
illustrated by figure B-3, which is taken from a NASA-Ames simulation model. Neglecting details 
such as the minor disturbance owing to compressor bleed-valve operation (fig. B-3), this thrust 
variation can be represented nondimensionally by the empirical equations 

N = 5 1 + 0.5 5 t 0 < 5. r < 96% ( B-8c) 
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(T 0 /T st )/5 = 0.765 [(N/Ve )/100l - 0.34 

51% < N/Vo < 75% 

(B-8d) 

(T () /T SJ )/5= 17.47 [l - N/V0)/1OO] 3 

75% < N/Ve < 100% 

(B-8e) 


+ 4.04 [(N/Ve)/1 00] -3.07 


where the throttle setting 5r and the rpm N are expressed in percent of maximum, To/5 denotes the 
corrected static (M = 0) thrust, and Tst denotes the manufacturer’s rated thrust. The maximum avail- 
able thrust is taken as 97% of rated static thrust to account for installation losses (Shevell, 1989). 

The variation of nondimensional corrected thrust with Mach number at constant corrected rpm can 
be approximated by the empirical equations 

(T/T sj )/5 = [T () /T st )/5] [1 — 1 .224 M + 1 .398 M 2 ] M<0.3 (B-8f) 

(T/T sj )/5 = [T () AT st )/ 5] [0.874 - 0.385 M] M > 0.3 (B-8g) 

where the nondimensional corrected static thrust (T 0 /Tst)/5 is given by equations (B-8d), (B-8e). 

The characteristic decrease of thrust with increase of Mach number results from momentum loss in 
the airstream entering the engine owing to deceleration within the inlet, which is termed ram drag. 



Figure B-3. Variation of corrected thrust with corrected rpm. 
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Thrust Limits 


Equations (B-8d) and (B-8e) do not apply to the maximum available thrust T MAX except at sea level, 
because at maximum thrust the physical rpm, not the corrected rpm, must be held fixed at its maxi- 
mum value. With the physical rpm held constant, the corrected rpm varies with altitude, increasing 
according to equations (B-8d) and (B-8e) as the nondimensional temperature ratio 0 decreases with 
height until it reaches its minimum value in the constant-temperature stratosphere (table A-l). The 
resulting variation of thrust with Mach number is illustrated by figure B-4 for five altitudes ranging 
from sea level to 45,000 ft. 


The variation of maximum thrust illustrated by figure B-4 is given by the empirical equations 

1/2 


(Tmax^t )/8 = 0.970 - [1 . 1 87 - 7.737 (0 - 1)] M 


+ [1.356-8.840(0 1/2 - 1)] M 2 


M < 0.3 


(B-8h) 


(T A ^J / 5 = 0M-0.373M 

MAX ST 


+ (0.796 + 2.433 M)(0 1/2 -1) 


M >0.3 


(B-8i) 


The (O' 1,2 - 1 ) temperature factors in equations (B-8h) and (B-8i) account for the increase in thrust 
owing to the increase in corrected rpm. This temperature factor, which is constant at about 15% 
within the stratosphere, approximately compensates the thrust loss owing to ram drag, so that for 
M > 0.3 the maximum thrust is nearly independent of Mach number at 35,000 ft and 45,000 ft 
(fig. B-4). Other engine limits such as turbine temperature limits (which are not represented in 
figure B-4) may limit available thrust under some conditions. 



Figure B-4. Variation of maximum thrust with Mach number. 
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Thrust Lag 


The throttle of a turbine engine controls the rate at which fuel is admitted to the combustion cham- 
ber, which must be limited within the fuel control to avoid excessive turbine temperature during 
engine acceleration. The resulting limitation of available shaft torque combines with the inertia of 
the rotating parts to cause a characteristic lag in the response of rotational shaft speed (rpm) to a 
throttle command. For correct physical modeling, a dynamical lag function should be applied to the 
shaft rpm to represent the effects of fuel-control limiting and rotational inertia, and the thrust should 
then be calculated from this lagged rpm according to the nonlinear equations (B-8c), (B-8d), and 
(B-8e). 

However, for simplicity the lag function can be applied directly to the thrust commanded by the 
throttle, provided that the time constants and rate limits involved are adjusted to represent the actual 
lag in the thrust function correctly. Such an adjusted lag function is illustrated by the block diagram 
of figure B-5, which is taken from a NASA-Ames simulation model. It can be seen that the thrust lag 
is represented by a critically damped second-order system that is equivalent to two first-order expo- 
nential lags in cascade, each with a characteristic time constant of 0.5 sec. 

The thrust response to abrupt full-throttle step commands, including the effects of the acceleration 
and rate limiters (fig. B-5), is illustrated by figure B-6(a). It can be seen that, starting from at least 
85% rpm (50% thrust), the thrust response is crisp, reaching full thrust in slightly more than 2 sec. 



Engine respoonse characteristics 

• s 4.0 rad/sec, Ceng = 10 

♦ Limiters: 

Acceleration 


Rate 


• Upper limit L3 = 

fcn(t g . 

r Tc ssj ) 

• No lower limit 



• Upper limit LI = 

0.0925 * { 

Tg max) 

Tg max 

= ( t g /8 amb) max 

• Lower limit L2 = 

-0.020 * ( 

Tq max) 


J AMB 


Figure B-5(a). Thrust response block diagram. 
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Note: 


3. Repeat for each engine, i = 1, 2, 3, 4 


1A = T Gss .-T Gj 

2. T* = ( ) . 5 amb 4. (t g / 6 amb ) Defined by figure B-3 

° AMB MAX 

Enter 



( E>il ) 


Figure 5(b). Acceleration limit logic. 


With initial rpm below 78% (30% thrust), fuel limiting increases the lag substantially, with about 
8 seconds required to reach full thrust when starting from idle. The thrust response to abrupt 
reduced-thrust step commands is illustrated by figure B-6(b). 

The degrading effect of thrust lag on control of airspeed is most critical during landing approach, 
when the need for precise airspeed control is greatest. During landing approach, extension of landing 
gear and wing flaps reduces the lift/drag ratio to about 7 (not represented in table B-l). For a wing 
loading of 1 1 0 lb/ft" at landing weight, about 26.5% of maximum thrust is required for steady flight 
on a standard three-degree approach flightpath angle (equation B-2(a)). It can be seen from 
figure B-6 that thrust response would then be somewhat degraded. 
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Thrust T G , lbs Thrust T G , lbs 



a) Acceleration 



b) Deceleration 

Figure B-6. Thrust response to throttle steps. 


AIRPLANE PERFORMANCE 


Performance of an aircraft in steady flight is determined by the steady-state (equilibrium) solution 
of the streamwise and normal force equations (B-2a) and (B-2b). For simplicity, flight in still air is 
assumed. However, as noted previously, the equations of motion remain unchanged in form for 
flight in a steady wind, provided that the speed V and the flightpath angle y are measured with 
respect to the airmass (eq. (B-3)). In still air, the airspeed V and the aerodynamic flightpath angle y 
coincide with their inertial counterparts. In equilibrium flight, the longitudinal acceleration dV/dt 
and the normal acceleration V(dy/dt) must vanish, so that, denoting the equilibrium (trim) flightpath 
angle by Ytrim, the force equations become 


and 


sin 


^TRIM 


= (T - D)AV 


(B-9a) 


cos ^tr.m =L/W (B ‘ 9b) 

Expressing the lift, drag, and weight forces in coefficient form (equations (B-6c), (B-6d)), the force 
equations become 


and 


sin y 


TRIM 


T_ 

W 



cos y 


TRIM 



(B-9c) 


(B-9d) 


where Cl = L/qS, Cd = D/qS, and Cw = W/qS, and the dynamic pressure q is defined as usual by 
q = pV : /2, or alternatively by q = y s pM 2 /2 (eq. (B-6f)). 

Assuming for simplicity that the drag characteristic of the aircraft can be represented by a parabolic 
polar curve (Shevell, 1989), the drag coefficient Cd is given by: 

C D = C DP +C L 2/7tARe (B-7c) 

Performance Envelope 

The performance envelope of the aircraft is determined by the variation of Ytrim with equivalent air- 
speed or with Mach number, which can be calculated as follows. Substitute equation (B-7c) into 
equation (B-9c): 


S,n ?TR,M= — “ 


L 

w 


c 


DP 


'w 


C JiAR e 

w 


(B-lOa) 
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Substitute equation (B-7c) into equation (B-lOa) to eliminate Cl: 


w 


(B-lOb) 


With the identity cos' ymiM = • - sin' Ytrim, equation (B-lOb) becomes 


sin y. 


t C C 

W • 2 I T)P W 

sin v = 

• TP IM 


TRIM 7i AR e ™ IM W C 7t AR e 

w 


(B-lOc) 


With Cw = W/qS and f= p () Vf./2, equation (B-IOc) becomes, finally. 


sin y 


t r| m n e p v 2 p 

M) E 


W/S . 2 T c 2 

0 - k * TRIM 1= 


W/S 


W W/S 0 E ttAR e P V -/2 

E 
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For convenience, the notation is repeated as follows: 

English symbols 


A 

a(H) 

AR = 
b 

b 2 /S 

Cdp 

Cdp (M) 

e = 

H 

e(M) 

M = 

N 

Po 

f 

S 

V/a 

T/8 

fn (N, M) 

V E 

vVa 


W/S 


5 = p/p () = 8(H) 

Ytrim 

Po 

a = p/p» = a(H) 


Sonic velocity, ft/sec 

Wing aspect ratio, dimensionless 

Wing span, ft 

Parasite drag coefficient, dimensionless 
Span efficiency, dimensionless 
Height in standard atmosphere, ft 
Mach number, dimensionless 
Engine rpm, percent 

Standard sea-level barometric pressure, 2 1 1 6.22 lb/ft 2 
Dynamic pressure, lb/ft : 

Wing area, ft 2 
Corrected thrust, lb 
Equivalent airspeed, ft/sec 
Wing loading, lb/ft 2 

Greek symbols 

Ambient pressure ratio, dimensionless 
Trim (equilibrium) flightpath angle, deg 
Standard sea-level density, 0.00237 691 sl/ft 3 
Ambient density ratio, dimensionless 
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Equation (B-lOd) gives the variation of the equilibrium (steady-state) flightpath angle Ytrim with 
equivalent airspeed Ve, with the thrust T (or, alternatively, engine rpm N) as parameter. It can be 
seen that, at a known height H in the standard atmosphere (app. A) and at a selected equivalent air- 
speed V E , and with known aircraft parameters T/W, W/S, Cdp , AR, and e, equation (B-lOd) is quad- 
ratic in sin Ytrim and can be solved for Ytrim in closed form. The following parameter values are 
representative for a transport aircraft climbing with maximum thrust at sea level at the minimum- 
drag airspeed (table B-l): 

W/S = 150 lb/ft 2 C DP = 0.0150 AR = 7.19 e = 0.83 

V = 487.9 ft/sec V E = 289.1kt M = 0.437 T/W = 0.1 765 

With these parameter values, equation (B-lOd) becomes 

sin ?TR.M ~ ®-028 286 sin 2 Y TRIM =0.1200 (B-lOe) 

The numerical solution for sin Ytrim is 17.6766 ± 17.5562, or, since the property sin (•) < 1 rules out 
the positive sign, 


sin Ytrim — 0.1204 Ytrim — 6.92 deg 

Since Ytrim is small, the exact result differs trivially from the approximation obtained by neglecting 
the small sin 2 Ytrim term. At this climb angle and airspeed, the lift coefficient, the drag coefficient, 
the lift/drag ratio, and the rate of climb are found for reference to be 

C L = 0.53 C D = 0.0298 L/D = 1 7.7 dH/dt = 3524 ft/min 

Repeating the calculation over the airspeed range of interest and plotting Ytrim against Ve or M 
(eq. (B-7m) defines the contour for maximum thrust, which forms the upper boundary of the flight 
envelope. The contour for minimum (idle) thrust forms the lower boundary. Contours for intermedi- 
ate values of thrust can be added as desired to complete the diagram for the aircraft performance 
envelope (Innis, Holzhauser, and Quigley, 1970). 

A second set of contours corresponding to constant pitch attitude can be constructed in the following 
way. Solve equation (B-9d) for the lift coefficient 

C l= C w cos '»tr,m=< W/< 1 S ) cos ’<™m 

which determines the lift coefficient for any point (Ve, Ytrim) within the flight envelope, since Ytrim 
is given by the ordinate and the dynamic pressure ^ is determined by the abscissa Ve or M. Now, the 
lift coefficient is related to angle of attack by equation (B-7a), which can be solved to find the angle 
of attack corresponding to the selected point. With both the flightpath angle Ytrim and the angle of 
attack a known, the pitch attitude 0 can be found from equation (B-l) 


B-24 


0 = a + 7 


(B-l) 


which is valid for wings-level flight. 

A representative flight envelope is illustrated by figure B-7. The left-hand boundary corresponds to 
the stalling speed, or to the minimum-control speed. The right-hand boundary is determined by 
structural limits at low altitude, and by compressibility (Mach) effects at high altitude. The upper 
and lower boundaries are determined by the maximum and minimum thrust limits, respectively, as 
noted previously. Because at any fixed throttle setting (constant engine rpm) thrust decreases with 
speed (eqs. (B-8f) and (B-8g)), the thrust contours take on their maximum values of Ytrim at air- 
speeds slightly below the speed for minimum drag. 

During manual flight, the pilot controls pitch with elevator and engine rpm with throttle. It can be 
seen from figure B-7 that the steady-state solution of the force equations (B-2a), (B-2b) for any 
combination of control inputs is determined by the intersection of the pitch and rpm contours corres- 
ponding to those control inputs. The desired steady-state solution will be termed the target operating 
point. The next sections discuss the selection of operating points within the performance envelope so 
as to optimize climb, cruise, and descent performance. 
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Figure B-7. Performance envelope. 
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Cruise Performance 


Optimization of cruise performance is a dominant influence in the design of transport aircraft, 
reflecting the importance of economic factors. Selection of the cruise operating point, which is based 
on maximizing specific range, is examined first. 

Specific range 

The specific range is defined as the distance flown in still air per unit weight of fuel consumed, 
which is found by dividing airspeed by the fuel flow rate: 

sr = dR/dF = (dR/dt) / (dF/dt) = V/(dF/dt) = V/c T (B-l 1 a) 

where the notation is as follows: 

F Fuel quantity, lb dF/dt 

R Range, nautical miles (nm) T 

sr Specific range, nm/lb V 

c Specific fuel consumption, Ib/hr per lb thrust 

Since cruise operation takes place in steady level flight, lift must equal aircraft weight and thrust 
must equal drag (eqs. (B-2a), (B-2b), and (B-7c)). The fuel flow rate is proportional to thrust, so that 

dF/dt = c T = c D = c L / (L/D) = c W / (L/D) (B-l lb) 

By substituting equation (B-l lb) into equation (B-l la) and putting V = M a (eq. (B-5)), the specific 
range equation can be put in the form 


Fuel flow rate, lb/hr 
Thrust, lb 

Airspeed, knots (nm/hr) 


sr = (a/c) M (L/D) ( 1/W) (B-l lc) 

Since at any fixed altitude the sonic velocity a is constant (eqs. (A-8) and (A- 12)), and since for sim- 
plicity the specific fuel consumption c is assumed constant, equation (B-l lc) shows that maximizing 
the specific range requires maximizing the nondimensional product M(L/D). 

If the Mach number is restricted to lie below M = 0.6, in the range where compressibility drag is 
unimportant and an analytic representation of the drag polar is available (eq. (B-7c), then by expres- 
sing M as a function of the lift coefficient Cl (eq. (B-7e)), the product M(L/D) could be maximized 
by differentiation with respect to Cl (compare equation (B-7h)). However, such a result would be 
invalidated by the restriction to M < 0.6, because the maximum M(L/D) product is reached for 
M > 0.6 in the range where compressibility effects on drag are important. For the drag characteristics 
illustrated by figure B-2, it can be shown by numerical optimization that the product M(L/D) takes 
on its maximum value at M = 0.825, Cl = 0.46. For these conditions, the lift/drag ratio is 15.8 and 
the product M(L/D) is 13.035. 
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Optimal Altitude 

Since most transport aircraft operation takes place in the stratosphere where the sonic velocity a is 
constant (eq. (A- 12)), for simplicity the variation of a at slightly lower altitudes is neglected. Since 
the specific fuel consumption c has already been assumed constant, equation (B-l lc) shows that 
maximum specific range is obtained for maximum M(L/D) independent of altitude. With the maxi- 
mizing values of M and Cl known, equation (B-7e) can be solved for the parameter (W/S)/8, which 
will be termed normalized wing loading: 


(W/S)/8 = (y s P 0 M 2 /2)C l (B-12a) 

Numerically, since ys = 1 .40 for air and p (l = 2 1 1 6.22 lb/ft 2 (app. A), for an aircraft with the drag 
characteristics illustrated by figure B-2, and for M = 0.825, Cl = 0.46 at the point of maximum 
M(L/D), equation (B-l 2a) becomes 

(W/S)/8 = (0.7) (2 1 1 6.22) (0.825) 2 (0.46) = 463.8 lb/ft 2 (B-l 2b) 


This equation shows that, to maintain the normalized wing loading constant as the aircraft weight is 
reduced by fuel consumption, the aircraft should climb to a higher altitude at which the normalized 
pressure 8 is reduced proportionately. To illustrate this process, several representative combinations 
of wing loading and cruising altitude are tabulated in table B-2, relating the altitude to the normal- 
ized pressure 8 by solving the standard atmosphere equations (A-6a) and (A-9a) for the altitude H. 
The corresponding equivalent airspeed V E is given by equation (B-7m). 


TABLE B-2. OPTIMAL CRUISE ALTITUDE 


W/S, Ib/ft 2 

150 

125 

100 

75 

8 

0.323 415 

0.269 513 

0.215 610 

0.161 708 

H, ft 

28,1 10 

32,1 10 

36,824 

42,809 

V E , kt 

310.3 

283.3 

253.4 

219.5 


Fortunately, as Shevell points out (Shevell, 1989), the altitude optimum is broad, so that near- 
maximum specific range can be achieved without adhering closely to the optimal altitude. In 
practice, the optimal altitude is approximated by a step-climb procedure. 

Maximum range 

Since the aircraft weight is reduced as fuel is consumed, so that dF = - dW, in differential form 
equation (B-l la) becomes 

dR = sr dF = -dW 


Eliminating the specific range sr with the help of equation (B-l lc), this becomes 

dR = (a/c) M (L/D) (-dW/W) (B-13a) 
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Provided that the parameters a, c, and M(L/D) remain constant, equation (B-13a) can be integrated 
to obtain the range: 


R = (a/c) M (L/D) In (W 0 /W F ) (B-13b) 

where Wo denotes the initial weight and W P the final weight. Equation (B-13b) is known as the 
Breguet range equation. In practice, the integration interval is broken into small weight intervals 
representing about 1 hour of flight. Within each interval, the integrand parameters can be taken as 
constant with good accuracy. 

Since W P = W 0 - F 0 = W 0 (1 - F 0 /W 0 ), where F 0 denotes the initial fuel load, the range equation 
( B- 1 3b) can be put in the form 


R = (a/c) M (L/D) In [W () /(l - F () /W () )] (B-13c) 

The parameter Fo/Wo is termed the fuel fraction (of the total weight Wo). Similarly defining the 
payload fraction by W P /W 0 and the structure fraction by W s /Wo, the fuel fraction is given by 

F () /W = 1 - ( W p /W + W s /W) (B-13d) 

where W P is the weight of the payload and W s that of the empty aircraft with no fuel and only the 
crew on board. 

Economic influences 

To illustrate economic influences on design, the range performance is calculated from equation 
(B-13c) for a representative transport aircraft. The following parameter values are assumed for a 
maximum-range flight with maximum payload, but with fuel quantity limited by maximum takeoff 
weight: 


W p /W () = 0.20 W s /W () =0.46 F/W () =0.34 c = 0.65 (lb/hr)/lb 

Allowing for fuel reserves equal to 8% of the zero-fuel weight and for climb and maneuver fuel 
equal to 2.45% of the takeoff weight (Shevell, 1989), the fuel fraction available for cruise becomes 

(F /W ) = 0.34 - 0.08 (0.20 + 0.46) - 0.0245 = 0.2627 

v 0 o 'cruise 

Assuming for simplicity that optimal cruise altitude is maintained and that cruise takes place in the 
stratosphere, for which (app. A) 

a = p a = (0.867 1 0 1 )( 1 1 1 6.45 ft/sec) = 573.6 kt 
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the range is given by 


R = (573.6/0.65) (0.825) (15.8) In [1/(1 -0.2627)] (B-13c) 


or 

R = 11,500 In 1.3563 = 3505 nm 
for maximum payload and maximum takeoff weight. 

Assume now that the fuel tanks can be filled to capacity without exceeding the maximum takeoff 
weight limit by exchanging half the payload for additional fuel, so that the payload fraction becomes 
Wp/Wo = 0. 10 and the fuel fraction becomes Fo/Wo = 0.44. Repeating the calculation as before, 

(F / W V , Iien = 0.44 - 0.08 (0. 1 0 + 0.46) - 0.0245 = 0.3707 

and 

R = 11,500 In [1/(1 -0.3707)] = 5326 nm 
with maximum fuel and half the maximum payload. 

Finally, assume that the fuel tanks are full with Fo/Wo = 0.44, but that it is desired to ferry the air- 
craft without payload. After reducing the takeoff weight 10% by removing the half payload of the 
previous case, the fuel fraction becomes Fo/Wo = 0.44/0.9 = 0.4889 and the structure fraction 
becomes Ws/Wo = 0.46/0.9 = 0.5 1 1 1 . Repeating the calculation, 

(F /W V miM =0.4889-0.08(0 + 0.51 1 1) - 0.0245 = 0.4235 

0 () CRUISE 

and 

R = 1 1,500 In [1/(1 - 0.4235)] = 6334 nm 

The additional thousand miles of range relative to the case with half payload results entirely from the 
reduction of weight. 

These results can be summarized in the form of a payload-vs-range diagram (fig. B-8). Despite the 
errors resulting from several simplifying assumptions, this diagram gives a good estimate of the 
range capabilities of transport aircraft designed for medium to long (transcontinental) range. Very 
long range (intercontinental) transports would have a somewhat larger fuel fraction and a smaller 
structure fraction, while short range transports would have a smaller fuel fraction, a larger structure 
fraction, and a much larger payload fraction. 

The sensitivity of operating economics to payload requires that cruise performance be balanced 
appropriately with airport performance during the design process, since airport performance (dis- 
cussed in the next section) limits the maximum takeoff weight. Because the specific range depends 
on both aerodynamic and propulsion efficiency factors, as already discussed, and because the struc- 
ture fraction is an inverse measure of structural efficiency, the payload-vs-range characteristic can be 
regarded as a bottom-line indicator of design excellence. 
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Optimal cruise altitude 


Mach number 0.825 


L/D 15.8 


sfc 0.65 Ib/hr per lb thrust 



Figure B-8. Variation of payload fraction with range. 


Airport Performance 

In addition to the optimization of cruise performance just discussed, a second dominant influence on 
transport aircraft design is the need for adequate airport performance, which is subject to safety 
requirements imposed by the Federal Air Regulations. 

Takeoff field length 

The distance X required to accelerate from rest to a speed Vx under constant acceleration ax is given 
by the well-known formula X = V x 2 /2ax- The lift-off speed Vx is nominally 1.2 V stall- With the 
stall speed given by equation (B-7g), Vx becomes 

V x= I - 2V S tau. = '- 2 V <2/ P )(W/S)/C lmax < B - 14a > 

Disregarding drag and assuming still air for simplicity, the acceleration during the takeoff ground 
run is obtained by substituting D = 0 and y = 0 into equation (B-2a): 

a x = dV , N /dl=(T/W) g ( B- 1 4b) 

Since thrust decreases with speed during the ground run (equations (B-8d) and (B-8f)), the thrust 
available at 0.7 Vx should be used in equation ( B- 1 4b) to obtain the average acceleration (Shevell, 
1989). By substituting equations ( B- 1 4a) and (B-14b) into the formula for constant-acceleration 
distance, the takeoff distance required to reach lift-off speed is found to be 
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x = [ 1 .44 (W/S)/C L MAX ]/pg (T/W) = ( 1 ,44/pg) [((W/S)/(TAV))/C L MAX ] 


(B-14c) 


Despite the errors introduced by simplifying assumptions, it is found that actual takeoff distances are 
roughly proportional to the bracketed quantity in equation (B-14c), which is widely used within the 
industry to predict takeoff performance during preliminary design. Even after accounting for the 
failure of one engine as required by the Federal Air Regulations, the bracketed quantity serves as a 
field-length correlation parameter with surprising accuracy (Shevell, 1989). 

Climb Gradient 

To ensure safe obstacle clearance after takeoff, the Federal Air Regulations specify the minimum 
climb gradient (tan y) that must be demonstrated both with and without failure of one engine. With 
the aircraft drag D and weight W known, the thrust loading T/W necessary to achieve the required 
steady climb gradient is found by solving equation (B-2a) for T/W with dV|N/dt = 0: 

T/W = D/W + sin y (B-15) 

With the thrust loading T/W fixed by the climb gradient requirements, equation (B-14c) shows that 
the takeoff field length is then proportional to the wing loading W/S. 

Landing Field Length 

Although the takeoff is essentially a Newtonian process, landing is much more dependent on pilot 
technique. The Federal Air Regulations require that a generous safety factor (67%) be added to the 
demonstrated landing distance to account for uncertainties. An additional 15% is added for wet 
pavement, and an additional safety factor results from prohibiting the use of reverse thrust during 
flight-test demonstrations of landing distance. Fortunately, landing field lengths are almost always 
shorter than takeoff field lengths, so that landing distance is seldom safety-critical. 

Design Overview 

Taken together, the desired cruise performance and the necessary airport performance determine the 
major elements of transport aircraft design. Readers wishing to supplement the following brief 
comments with more detailed discussion can consult Shevelfs 1989 text (Shevell, 1989), which 
draws on the author's experience as an industry designer to provide an especially clear account. 
Readers desiring discussion of operational matters involving pilot technique can consult Davies's 
classic Handling the Big Jets (Davies, 1969), which draws on the author’s experience as chief test 
pilot for the Air Registration Board (U.K.) to provide an interesting discussion of jet transport flying 
qualities. Davies’s treatment of airworthiness matters is authoritative. 

Design for Cruise Performance 

Considering first the major design elements determined by optimization of cruise performance, the 
parasite drag Cdp is proportional to wing thickness, and to the total wetted area of the wing, fuse- 
lage, and tail. Induced drag is determined primarily by the wing aspect ratio AR, and by wing taper 
and twist, which determine the span efficiency factor e. Compressibility drag at cruising speed is 
determined primarily by the airfoil shape and by the angle of wing sweep. 
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Design for Airport Performance 

The major design elements determined by the required airport performance are the wing loading 
W/S and the thrust loading T/W. As already noted, the thrust loading is determined primarily by the 
engine-out climb gradient required for safe obstacle clearance after takeoff. Representative thrust 
loadings lie near T/W = 0.25 at maximum takeoff weight, slightly less for four-engine aircraft and 
slightly more for twin-engine or three-engine aircraft to compensate for their larger engine-out thrust 
loss. Since the induced drag dominates the total drag characteristic at takeoff speed, the engine-out 
climb gradient of twin-engine aircraft is often improved by increasing the aspect ratio, enabling the 
required thrust loading to be decreased. Increasing the installed thrust would increase engine weight 
and cost, and could degrade the specific fuel consumption during cruise if the required cruise thrust 
were less than about 80% of the maximum thrust available at cruise altitude. Cruise thrust require- 
ments seldom size the engine. 

With the thrust loading fixed by climb gradient requirements, the takeoff field length is proportional 
to the wing loading W/S (eq. ( B- 1 4c)), as already noted. As increased thrust becomes available 
through engine development, economic pressure for increased payload tends to increase maximum 
takeoff weight proportionately, while maintaining thrust loading constant. If sufficient structural 
growth capability (“stretch”) is available, wing loading increases significantly as later models of the 
aircraft enter airline service, until practical field length limits are reached. As a rough guide, short- 
range transports are designed for ranges of 1000 to 2500 nm and takeoff field lengths of 6000 to 
8000 ft, with wing loadings up to 120 lb/ft'. Medium- and long-range transports are designed for 
transcontinental ranges of 2500 to 5000 nm and takeoff field lengths of 8000 to 10,000 ft, while very 
long range transports are designed for intercontinental ranges of 5000 to 7000 nm and takeoff field 
lengths of 10,000 to 12,000 ft, with wing loadings near 150 lb/ft 2 . 

Balance of Design Factors 

A successful transport aircraft design results from balancing competing requirements. To maximize 
the M(L/D) product in cruise, the aerodynamicist would like long, thin, highly swept wings with 
small surface area, and the smallest practical tail. 

To reduce wing structural weight and provide space for fuel tanks, the structural designer would like 
short, thick wings, and prefers small sweep angles to avoid problems with structural flexibility. 
Resolution of the conflicts between aerodynamic and structural designers for subsonic transport 
aircraft usually results in wing thickness about 10% of chord, aspect ratios in the range of 7 to 8, and 
sweep angles of 25 to 35 degrees. 

To reduce avionics weight and cost and to improve reliability, avionics and flight control designers 
would like a large tail that avoids the need for stability augmentation. Resolution of their conflict 
with the aerodynamicists is not yet clear, although transport aircraft with near-neutral natural stabil- 
ity are currently in service, and designs that would be unstable without augmentation are being 
proposed. 

To mitigate the operational penalties for engine failure and avoid the need for extremely high engine 
reliability for over-water flight, the propulsion designer would like several small engines, but 
reducing the customer’s maintenance costs favors two large ones. This conflict seems likely to be 
resolved in favor of large twin-engine designs by steady improvement in engine reliability. 
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As noted previously, the pay load- vs-range characteristic of a transport aircraft is a primary economic 
indicator of the capability of the aircraft for its intended purpose, and therefore constitutes an overall 
measure of its design excellence. The factors just discussed determine the major elements of each 
transport aircraft design. The following section discusses operation of the aircraft so as to minimize 
overall time and cost. 


AIRPLANE OPERATION 
Climb and Descent Operation 

The climb and descent operation of transport aircraft is often optimized so as to minimize total fuel 
consumption for each flight. For climb, thrust is reduced slightly from takeoff thrust in order to 
extend engine life. This reduced thrust setting is termed maximum continuous thrust. Idle thrust is 
used for the descent. With the thrust setting determined, climb and descent trajectories are optimized 
by selecting the appropriate airspeeds. 

Climb 

Three different airspeeds may be selected for climb, the choice depending on the quantity to be 
maximized. If climb gradient is to be maximized for obstacle clearance after takeoff or for some 
noise-abatement procedures, the airspeed for best angle of climb can be obtained from the perform- 
ance envelope diagram (fig. B-7). As noted previously, the airspeed for best angle of climb lies 
slightly below the speed for minimum drag. (Since minimizing drag also minimizes the rate of fuel 
consumption, the speed for minimum drag is also the speed that maximizes the time of flight avail- 
able with a fixed fuel quantity, which is termed endurance. For example, the speed selected for 
holding lies near the speed for minimum drag.) 

Since the vertical velocity dH/dt is equal to V sin y, the airspeed for best rate of climb lies above that 
for best angle of climb. The former airspeed can be found graphically by adding dH/dt contours to 
the performance envelope, as illustrated by figure B-9. The airspeed for best rate of climb lies at the 
point for which the contour for maximum continuous thrust is tangent to the hyperbolic dH/dt 
contours (fig. B-9). 

It can be seen that, as available thrust decreases with altitude, the speed for best rate of climb is 
reduced, approaching the speed for best angle of climb as the aircraft approaches its ceiling, where 
Ymax = 0. In practice, the maximum altitude is usually determined by the need for a small amount of 
reserve thrust, which is necessary to enable the aircraft to maneuver. It can be shown that, for coor- 
dinated turns, the increased lift required is found by dividing the lift for wings-level flight by the 
cosine of the bank angle (app. C). The resulting increase of induced drag (eq. (B-7c)) must be 
compensated by increased thrust to avoid loss of airspeed during turns. Independent of excess thrust, 
the aircraft’s ceiling is limited by stalling or by Mach buffet, because for fixed weight and Mach 
number the lift coefficient increases with altitude as atmospheric pressure decreases (eq. (B-7c)). 
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W/S S 150 Ib/sq ft 


T/W = 0.25 


Sea level 



The climb airspeed that minimizes total fuel consumption lies above that for best rate of climb, since 
the distance traveled during the climb is directly proportional to the climb speed, while the vertical 
velocity is reduced only slightly at speeds somewhat higher than that for best rate of climb 
(fig. B-9). In practice, transport aircraft usually climb at constant equivalent airspeed at low altitudes 
and constant Mach number at high altitudes. Shevell gives the following schedule for a high-speed 
climb for the DC-10 series 10 aircraft (Shevell, 1989): 

Altitude, ft 0-10,000 10,000-27,880 >27,880 

Vi as or M 250 kt 340 kt 0.85 M 

At the “cross-over” altitude of 27,880 ft, at M = 0.85 the equivalent airspeed is 321.4 kt (eqs. (B-7m) 
and (A-6a)). The pilot’s indicated airspeed (IAS) is 19 kt higher than the equivalent airspeed in this 
case because of the effect of compressibility on the aircraft pitot pressure. 

The time to climb is found by evaluating the integral 

t = JdH/(dH/dt) 

over the altitude range of interest. It is found that the initial climb to the optimal cruise altitude tends 
to require about 30 minutes, independent of aircraft weight. 
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Descent 

As already noted, idle thrust is used for descent. The residual thrust at idle can be neglected. With 
T = 0, equation (B-9a) shows that the descent angle is proportional to D/W, so that the distance 
traveled during descent is maximized by minimizing drag. Therefore, the descent airspeed is usually 
near the speed for minimum drag. 

The descent gradient is found by dividing equation (B-9a) by equation (B-9b), which results in the 
equation 


tan Y tr|M = (T - D)/L = (0 - D)/L = - 1/(L/D) (B- 1 6) 

Since the angle of descent is small, the lift is approximately equal to the weight (equation (B-9b)). 
With L/D = 17.7 for M < 0.6 (table B-l), the descent gradient is 1/17.7, or, since 1 nm equals 
1 852 m or 6076. 1 ft, the gradient is 6076. 1/1 7.7 = 343.3 ft/nm. Therefore, the distance traveled per 
1000 ft of descent is 1000/343.3 = 2.91 nm/10 3 ft. In practice, it is found that 3 nm per 1000 ft is a 
good estimate of the descent gradient for most transport aircraft. 

Trajectory Optimization 

Optimization of climb, cruise, and descent by the methods just discussed does not, in general, result 
in the best complete flight profile from takeoff to landing, for two reasons. First, the methods pre- 
sented have concentrated on minimizing fuel consumption and fuel cost for a fixed range, but have 
not considered the cost of time. It is immediately obvious that combining the cost of time with fuel 
cost to form a weighted total cost that is to be minimized will lead to scheduled speeds higher than 
those that minimize fuel cost alone. 

Second, independent optimization of the climb, cruise, and descent flight segments does not neces- 
sarily result in optimization of the complete flight profile. In particular, optimization of the cruise 
segment has assumed that cruising flight should take place at the optimal cruise altitude. This 
assumption is correct for long flights that are dominated by the cruise segment, but for shorter flights 
it is found that optimization of a short cruise segment may not determine the optimal profile for the 
entire flight. Indeed, since about 30 min is usually required for climb to the optimal altitude, as 
already noted, very short trips may not contain any cruise segment whatever. Thus the classical, 
quasi-steady optimization methods presented previously can be regarded as approximations valid for 
long flights dominated by the cruise segment when fuel cost dominates the total cost. 

Modern Optimization 

The modem approach to trajectory optimization, which accounts specifically for interaction between 
climb, cruise, and descent segments, is accomplished by application of optimal control theory based 
on calculus of variations (Erzberger and Lee, 1978; Lee and Erzberger, 1980; Erzberger, 1982). Fuel 
savings of 2 to 3 percent can be achieved for short trips, for which quasi-steady approximations are 
especially inaccurate. Although the modem approach leads to a mathematically complex problem 
that lies beyond the scope of this appendix, the following brief comments indicate the problem 
formulation. Readers desiring a detailed treatment can consult the references provided. 
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The cost function J to be minimized consists of the sum of the fuel cost and the time cost integrated 
over the time of flight: 


J =jT,MH< f c dF/dt + 1 o> dl < B ' 17a > 

where f c and t c are the unit costs of fuel and time and F denotes fuel quantity. Time is now replaced 
as the independent variable in equation (B-17a) by the total energy of the aircraft. This energy-state 
approach to performance optimization recognizes that the total energy of the aircraft is increased not 
just by climbing, but also by accelerating to cruising speed. The resulting cruise energy is dissipated 
during descent and landing. The objective of optimization can then be regarded as the increase and 
decrease of total energy in the most desirable way; that is, at least cost (Shevell, 1989). 

Specific energy- The total specific energy e of the aircraft per unit weight is the sum of its potential 
energy and its kinetic energy: 


e = H + V 2 /2g (B- 1 7b) 

where H denotes altitude, V denotes airspeed, and g denotes gravitational acceleration. Differentia- 
ting equation (B-17b), the specific energy rate is given by 

de/dt = dH /dt + (V/g) (dV/dt) (B-17c) 

Substituting dH/dt = V sin y, equation (B-17c) becomes 

de/dt = V [sin y+ ( 1/g) (dV/dt)] ( B- 1 7d) 

Recognizing the bracketed quantity in equation ( B- 1 7d) as the quantity (T - D)/W = sin Ytrim 
( eqs. (B-2a) and (B-9a)), the specific energy rate becomes 

de/dt = V (T - D)/W = V sin y TDIk , (B- 1 7e) 

TRIM 

By replacing time as the independent variable using the transformation dt = de/( de/dt), equation 
( B- 1 7a) becomes 


,=f c /energy <dF/d.y<de/dt)de-M J energy l/ « te ' dl > d e < B ' l7 fi 

The integration limits in equation (B-17f) are the initial and final values of specific energy, which 
are found from the initial and final altitudes and airspeeds using equation (B-l 7b), and the maximum 
energy, which is discussed next. 

Numerical optimization- It is now assumed that the optimal trajectory, which minimizes the cost 
function J, consists of, at most, three segments: (1) a climb segment characterized by monotonically 
increasing specific energy; (2) a constant-energy cruise segment, if any; and (3) a descent segment 
characterized by monotonically decreasing specific energy. Within each segment, the scheduled 
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airspeed is selected numerically so as to minimize the cost function at each energy level. The opti- 
mal thrust schedule can be determined numerically in the same way, but it is found that using 
maximum continuous thrust for the climb and idle thrust for the descent is nearly optimal. 

The climb segment begins at the initial energy and ends at the maximum (cruise) energy, and the 
descent segment begins at the maximum energy and ends at the final energy. The maximum energy 
increases with range until the optimal cruise energy is reached, as determined from equation (B-17b) 
for the optimal cruise altitude and speed. For shorter trips without a cruise segment, the maximum 
energy is determined by the desired total range. 

Graphical optimization- Shevell presents a relatively simple graphical treatment of the minimum- 
time and minimum-fuel climb trajectories that provides insight into the nature of the optimal solu- 
tions (Shevell, 1989). The corresponding descent problems could be handled in the same way. For 
supersonic aircraft, it is shown that energy-state methods have decisive advantages over classical 
methods for trajectory optimization, defining entirely different trajectories that are much more 
efficient. 


Operation Overview 

The planned trajectory of a transport aircraft in space and time can be determined almost entirely by 
the considerations of optimization just discussed, which determine the selection of operating points 
within the aircraft performance envelope and the schedules of airspeed and thrust to be employed. 
Appropriate trajectory-planning optimization algorithms are incorporated within the flight manage- 
ment systems on board current transport aircraft. Flowever, the minimization of cost is also subject 
to external constraints imposed by Air Traffic Control (ATC) to provide separation from other air 
traffic. In the absence of such external constraints, trajectories can be selected to achieve the uncon- 
strained optimum determined by the methods just discussed. As traffic density increases, optimality 
must be sacrificed to a greater or lesser extent as required for separation. In heavy traffic situations, 
feasible trajectories can be determined almost entirely by traffic constraints, leaving little freedom 
for optimization. 

The global problem of optimizing trajectories subject to traffic constraints is extremely complex, 
involving, in principle, the trajectories of all aircraft operating within the worldwide air traffic con- 
trol system. Global optimization must consider criteria related to system capacity and safety, in 
addition to the costs borne by aircraft operators. These problems are currently being addressed at the 
research level (Erzberger and Nedell, 1989; Erzberger, Davis, and Green, 1993). 

Current research indicates that efficient global optimization will require exchange of trajectory 
specifications between airborne and ground-based computers. With concurrence of pilots and air 
traffic controllers, profile negotiation algorithms will be iterated until convergence is achieved 
(Green, Den Braven, and Williams, 1993). It is hoped that future development of well-coordinated 
airborne and ground-based systems will enable significant increases in system capacity, improve- 
ments in operational safety, and reductions in cost. 
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AIRPLANE DYNAMIC RESPONSE 


The dynamic response of a transport aircraft to elevator and throttle control depends on the initial 
operating point within the aircraft performance envelope. Operating points are selected to realize the 
flight profile summarized by the flight plan, as already discussed. Each operating point corresponds 
to a steady-state solution of the equations of motion for specified elevator and throttle control inputs, 
and the transitions from one operating point to the next correspond to transient solutions of the 
equations of motion. Flying-qualities criteria based on pilot evaluation define what is meant by well- 
shaped responses, which enable smooth, rapid capture of the desired (target) operating point during 
manual control. 

The following sections examine dynamic response by means of simulation (that is, by numerical 
solution of the equations of motion) at three different levels of dynamical fidelity, and interpret vari- 
ous flying-qualities criteria that guide stability and control aspects of aircraft design. Automatic 
systems should be designed to achieve response shapes similar to those desired for manual control, 
since from the flying-qualities viewpoint it can be taken as axiomatic that behavior that is difficult to 
anticipate is difficult to monitor. Readers who wish to skip the details of the simulation calculations 
can turn immediately to the discussion in the section “Aircraft Response Characteristics.” 

Three-Degree-of-Freedom Model 

At airspeeds below M = 0.6, compressibility effects are unimportant, as previously noted. In this 
speed range, the aircraft lift coefficient is a linear function of angle of attack (eqs. (B-7a) and 
(B-7b)), and its pitching moment coefficient can be represented as a linear function of elevator and 
stabilizer deflections and of pitch rate, which is proportional to tail angle of attack (eq. (B-6e)). 

For M < 0.6, the drag coefficient is a nonlinear function of lift coefficient (eq. (B-7c)), and the 
dimensional aerodynamic forces and moments are nonlinear functions of airspeed (eqs. (B-6d) and 
(B-6e)). At higher Mach numbers, compressibility effects would contribute other Mach-dependent 
nonlinearities. 

Stability and Control Parameters 

For simplicity, it is assumed that the aircraft is initially trimmed in level flight in still air at the 
minimum-drag airspeed. The trim condition is specified by the steady-state solution of the equations 
of motion (B-2a), (B-2b), and (B-2c). The stabilizer is adjusted to balance the total pitching moment 
with the elevator faired (5 C = 0). Representative parameter values for a transport aircraft at normal 
landing weight at 15,000 ft can be found in table B-3, which also shows how the various partial 
derivatives vary with airspeed, V M d denoting the minimum-drag speed. Estimation of these param- 
eters, which makes use of available transport aircraft data, lies beyond the scope of this appendix. 
Readers desiring a more detailed discussion can consult standard engineering references dealing 
with aircraft stability and control (McRuer, Ashkenas, and Graham, 1973). For simplicity, small 
contributions to the aerodynamic forces and to the pitching moment have been neglected. With these 
assumptions, the dynamical system corresponding to the longitudinal equations of motion (B-2a), 
(B-2b), and (B2c) can be represented by the block diagram of figure B-10(a). 
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TABLE B-3. TRANSPORT AIRCRAFT STABILITY AND CONTROL PARAMETERS 


(1/I Y ) dM/d5 c = + 3.61 (V/Vmd) 2 rad/sec 2 per rad = + 3.61 (V/Vmd)" deg/sec" per deg 
( 1/I Y ) dM/da = - 3.03 (V/Vmd) 2 rad/sec 2 per rad = - 3.03 (V/V M d) 2 deg/sec 2 per deg 
( l/I Y )dM/d(da/dt) = - 0.554 (V/V M d) rad/sec 2 per rad = - 0.554 (V/V M d) deg/sec 2 per deg 
( l/I Y )dM/dq = - 1 .66 (V/Vmd) rad/sec 2 per rad/sec = - 1 .66 (V/Vmd) deg/sec' per deg/sec 
(l/W)dL/d5 e = - 0.97 (V/Vmd) 2 g’s per rad = - 0.0169 (V/V M d) 2 g’s per deg 
(1/W) dL/da = + 8.65 (V/Vmd) 2 g’s per rad = + 0.151 (V/V M d) 2 g’s per deg 
g/V = 0.0675 (Vmd/V) rad/sec per g unit = 3.87 (Vmd/V) deg/sec per g unit 
a* =* — 4.84 deg a, r j,n = + 1 .7825 deg V M d = 476.39 ft/sec 
(1/W) T t rim = 0.07058 (1/W) dT/d(V/V MD ) = -1/71.387 

(1/2) (L/D)max = 0.028 286 g = 32.174 ft/sec 2 


Block Diagram 

The simplified block diagrams of figures B-10(b), B-10(c), and B-10(d) are discussed later, and 
should be ignored for the present. In figure B-10(a), the solid lines denote parameters appearing in 
the equations of motion, starting with the elevator and throttle control inputs at the left. The arrows 
indicate the sequence of computation. Each block indicates that the quantity entering that block is to 
be multiplied by the parameter within the block. Addition of signals is indicated by small circles 
containing a plus sign, with subtraction denoted by minus signs adjacent to the appropriate arrows. 
Time integration of the quantity entering a block is indicated by an integral sign within the block. 
The symbol D within a block denotes a one-frame delay. (In the spread-sheet implementation to be 
described, delayed quantities are taken from the previous row of the spread-sheet table.) 

Terminology 

It can be seen that the increment of total pitching moment M contributed by the elevator deflection 
5 C is specified by the parameter dM/d5 c , which is termed elevator effectiveness. Similarly, the con- 
tribution of elevator deflection to the tail download, which reduces total lift, is specified by the 
parameter dL/d5 c . The contribution of angle of attack to total pitching moment is specified by the 
parameter dM/da, which is termed static stability. The contribution of pitch rate to total pitching 
moment is specified by the parameter dM/dq, which is termed pitch damping. The contribution of 
angle-of-attack rate to total pitching moment owing to down wash lag at the tail is specified by the 
parameter dM/d(da/dt). The primary contribution to total lift is that owing to the wing, which is 
proportional to the lift-curve slope specified by the parameter dL/da. Representative numerical 
values of these parameters, which are marked on figure B- 10(a), can be found in table B-3, as 
already noted. 
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a) 

Figure B-10. Longitudinal dynamical system. 



b) Three-degree-of-freedom model. 
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d) Single-degree-of-freedom model. 
Figure B-10. Longitudinal dynamical system (concluded). 


Functional Description 

The arrangement of the block diagram of figure B- 10(a) follows certain conventions related to 
physical significance. It can be seen that each of the forward paths leading from the elevator and 
throttle control inputs 5 C and on the left through the integrators to the controlled variables (that 
is, the pitch angle 0, the flightpath angle y, and the airspeed V) is drawn from left to right in the 
diagram. The other paths drawn from right to left represent feedback that modifies the forces and 
moments generated by the control inputs. Considering the forward paths first, the path at the top of 
the diagram leading from the pitching moment summation point (marked ZM in the diagram) to the 
pitch angle 0 on the right corresponds to the solution of the pitching moment equation (B-2c) 

dq/dt = M/I y (B-2c) 

since integrating equation (B-2c) twice yields the equation 

e= e TK,M + h d ' = e TK,M + //<dq/ ( it,d I = e TR1M + JJ<M/I v )d, 
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Similarly, the forward path at the center of the diagram leading from the lift summation point 
marked ZL to the flightpath angle yon the right corresponds to the solution of equation (B-2b) in the 
form 


Y = Y tr1m + j(g /v ) [LAV - cos y] dt 

where Ytrim vanishes for initialization in level flight. At the bottom of the diagram, the forward path 
leading from the streamwise force summation marked (T - D)/W to the airspeed V on the right 
corresponds to the solution of equation (B-2a) in the form 

V = V TRIM + j-[ (T - D)/W - Sin ^ dt 
where Vjrim = Vmin drag = Vmd- 


To derive the angle of attack feedback, the fuselage angle of attack a is formed according to 
equation (B-l): 

a = 0 - y (B-l) 

The aerodynamic (wing) angle of attack is obtained by correcting for the wing incidence angle ctj 
between wing and fuselage. The angle of attack feedback contributes to the total pitching moment 
ZM through the static stability parameter dM/da, and contributes to the total lift ZL through the lift- 
curve slope dL/da. Numerically, the pitching moment of inertia Iy and the weight W are included in 
these parameter values. As already noted, the time derivative of angle of attack dcx/dt contributes to 
the total pitching moment ZM through the downwash lag parameter dM/d(da/dt). 

At the bottom of the diagram, the airspeed V is fed back to determine the drag/weight ratio D/W as 
follows. Expressing this ratio in coefficient form with the help of equation (B-7c), 

D/W = C D /C W = C DP /C W + ( C L /C W > W AR e 

Normalizing by the minimum-drag lift coefficient Cl min drag = Cl md, 

D/W = ( C , jp /C L MD ) ( C L M1 /C w ) + <C L /C W ) <C LMD /KARe) <C L /C LMD ) 

According to equation (B-7j), 

C „H /C L MD = < C „ C L MD = <' /2 > < D/L >M,N = < ^MAX 

Also, C L md/Cw = (V/V,.,„) : (eq. (B-70), and C L /Cw = L/W. Therefore, 

D/W =(I/2) <V/V m|) ) 2 /(L/D W + (1/2) (L/W) (V M1) /V) 2 /(UD) MAX 
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where the first term on the right represents the contribution of parasite drag and the second term that 
of induced drag, as shown in the block diagram. The remaining airspeed feedback modifies the 
thrust according to equation (B-8g), which is valid for M > 0.3 (V > 187.9 kt). 

Numerical Integration 

The equations of motion can be solved numerically to determine the dynamic response of the aircraft 
to any physically realizable elevator and throttle control inputs. If this solution is carried out in real 
time, it can provide the basis for piloted simulation. Two numerical integration methods commonly 
used for real-time simulation are second-order Adams-Bashforth prediction with Adams-Moulton 
correction, or for simplicity, Adams-Bashforth prediction alone (Press et al, 1986). These second- 
order prediction-correction methods, which are based on the well-known trapezoidal rule, are much 
more accurate for smooth input functions than first-order numerical methods such as Euler integra- 
tion, and they are also more accurate than higher-order prediction-correction methods for impulsive 
inputs such as landing gear loads at touch-down. High-accuracy methods such as fourth-order 
Runge-Kutta integration (often available in computation libraries) are too slow for real-time simula- 
tion because they require more function evaluations (which must, in general, be performed by time- 
consuming table look-up). The integration time step should be made as short as practicable, since 
excessive step length degrades accuracy and numerical stability. 

In practice, step lengths of 25 msec are representative for transport aircraft simulation. The follow- 
ing sections describe dynamic responses calculated with 25-msec time steps, as implemented by 
means of a widely available general-purpose spread-sheet package. The Adams-Bashforth prediction 
method is illustrated by example. The response of the aircraft to an abrupt change of elevator deflec- 
tion, termed an elevator step, is calculated first. To ensure physical realizability, the mathematically 
discontinuous step is shaped by multiplying it by a half-period cosine bell of 0.5-sec duration, which 
is representative of an abrupt pilot control input. 

Calculation of Elevator Step Response 

The quantities to be calculated are the aircraft state variables, which are the outputs of the four inte- 
grators shown in figure B- 10(a). It may be seen that these four quantities are pitch rate, pitch angle, 
flightpath angle, and airspeed. 

Pitch response- Since the pitch response has the widest bandwidth and the shortest time scale, pitch 
rate and pitch angle are calculated first. The first step is to sum the contributions to total pitching 
moment, dividing by the moment of inertia ly to obtain the pitch acceleration dq/dt (point A in 
figure B- 10(a)). Since the aircraft is assumed to be in equilibrium (trim) initially, the initial pitching- 
moment contributions from pitch rate q and angle-of-attack rate da/dt both vanish, and the stabilizer 
deflection Sstab is adjusted so as to balance the contribution from angle of attack. The pitch accel- 
eration dq/dt at point A corresponds to that on the left side of the pitching-moment equation (B-2c). 
Next, the pitch rate q at time t = 0.025 sec (point B in figure B- 10(a)) is found by Adams-Bashforth 
prediction. 
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If the pitch acceleration were known at time t = 0.025 sec, then the desired pitch rate could be found 
by numerical integration of equation (B-2c) using the trapezoidal rule: 

q, =q 0 + j A| (dq/dt) dt = q () + [(dq/dt) ( + (dq/dt) () ] At/2 (B-18a) 

where the subscript 0 denotes the time t = 0, the subscript 1 denotes the time t = 0.025 sec, and At 
denotes the 0.025-sec time step. Since the pitch acceleration (dq/dt)i is not known, the Adams- 
Bashforth prediction method estimates it by linear extrapolation: 

(dq/dt)! = (dq/dt ) () + [(dq/dt) Q - (dq/dt )_ ( ] (B- 1 8b) 

where the subscript -1 has the obvious significance. Collecting terms and substituting equation 
(B-18b) into equation (B-18a), the pitching velocity qi becomes 

q, =q () + (3 At/2) (dq/dt ) o -(At/2) (dq/dt) ( (B-18c) 

Applying the Adams-Bashforth integration formula ( B- 1 8c) to the first time step, for which both 
(dq/dt).i and (dq/dt)o vanish by the assumption of initial equilibrium, the pitching velocity after the 
first step at time t = 0.025 sec is found to be 

q ( = 0 + (3 At/2) (dq/dt ) (| = (3/2) (0.025) (0.0889) = 0.0033 deg/sec 

Next, the pitch angle at time t = 0.025 sec (point C in figure B-10(a)) is found by evaluating the 
second integral, again using the Adams-Bashforth prediction formula. By analogy to equation 
(B-l 8c), 


e , = e o + Ja. q dt = e o + (3 At/2) % - ( At/2) 9-1 

where 0o = 1.7825 deg (table B-3), and both q 0 and q i vanish by initial assumption. The pitch angle 
0i at time t = 0.025 sec (point C) is found to be 

0, = 1.7825 + (3/2) (0.025) (0.0033) -(1/2) (0)= 1.7826 deg 

This completes the: pitch response calculation for the first time step. The results are summarized by 
table B-4. It can be seen that, with certain exceptions, the columns of the table correspond to the 
lettered points A, B, and C identified on figure B-l 0(a), and that each row corresponds to one time 
step. 
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TABLE B-4. ELEVATOR STEP RESPONSE 


Three Degrees of Freedom 



Elev 

Pitch 

Pitch 

Pitch 

Fltpath 

Fltpath 

Angle of 

Elev 

Time 

defl 

accel 

rate 

angle 

rate 

angle 

attack 

defl 

sec 

deg 

deg/s/s 

deg/sec 

deg 

deg/sec 

deg 

deg 

deg 

-0.025 

0.000 

0.0000 

0.0000 

1.7825 

0.0000 

0.0000 

1.7825 

0.000 

0.000 

0.000 

0.0000 

0.0000 

1.7825 

0.0000 

0.0000 

1.7825 

0.000 

0.025 

0.025 

0.0889 

0.0033 

1.7826 

-0.0016 

-0.0001 

1.7827 

0.025 

0.050 

0.098 

0.3446 

0.0151 

1.7832 

-0.0063 

-0.0003 

1.7834 

0.098 

0.075 

0.218 

0.7471 

0.0389 

1.7844 

-0.0137 

-0.0007 

1.7851 

0.218 

0.100 

0.382 

1.2773 

0.0774 

1.7868 

-0.0235 

-0.0014 

1.7883 

0.382 

0.125 

0.586 

1.9129 

0.1332 

1 .7909 

-0.0350 

-0.0024 

1.7933 

0.586 

0.150 

0.824 

2.6293 

0.2079 

1.7970 

-0.0476 

-0.0038 

1.8008 

0.824 

0.175 

1.092 

3.4002 

0.3025 

1.8057 

-0.0607 

-0.0055 

1.8112 

1.092 

0.200 

1.382 

4.1986 

0.4175 

1.8176 

-0.0736 

-0.0075 

1.8251 

1.382 

0.225 

1.687 

4.9966 

0.5523 

1.8331 

-0.0854 

-0.0098 

1 .8429 

1.687 

0.250 

2.000 

5.7670 

0.7061 

1.8527 

-0.0955 

-0.0123 

1.8650 

2.000 

0.275 

2.313 

6.4834 

0.8772 

1.8768 

-0.1030 

-0.0149 

1.8917 

2.313 

0.300 

2.618 

7.1213 

1.0632 

1.9057 

-0.1074 

-0.0177 

1.9233 

2.618 

0.325 

2.908 

7.6579 

1.2614 

1.9397 

-0.1078 

-0.0204 

1 .9600 

2.908 

0.350 

3.176 

8.0738 

1 .4684 

1.9790 

-0.1039 

-0.0229 

2.0019 

3.176 

0.375 

3.414 

8.3523 

1.6807 

2.0236 

-0.0950 

-0.0252 

2.0488 

3.414 

0.400 

3.618 

8.4809 

1.8943 

2.0737 

-0.0809 

-0.0270 

2.1007 

3.618 

0.425 

3.782 

8.4505 

2.1052 

2.1289 

-0.0613 

-0.0283 

2.1572 

3.782 

0.450 

3.902 

8.2567 

2.3092 

2.1892 

-0.0361 

-0.0289 

2.2181 

3.902 

0.475 

3.975 

7.8991 

2.5022 

2.2542 

-0.0053 

-0.0287 

2.2828 

3.975 

0.500 

4.000 

7.3817 

2.6803 

2.3234 

0.0309 

-0.0274 

2.3508 

4.000 

0.525 

4.000 

6.8014 

2.8431 

2.3965 

0.0707 

-0.0252 

2.4217 

4.000 

0.550 

4.000 

6.2483 

2.9924 

2.4732 

0.1121 

-0.0218 

2.4950 

4.000 

0.575 

4.000 

5.7184 

3.1287 

2.5531 

0.1549 

-0.0174 

2.5706 

4.000 

0.600 

4.000 

5.21 15 

3.2526 

2.6360 

0.1991 

-0.0119 

2.6479 

4.000 

0.625 

4.000 

4.7271 

3.3648 

2.7215 

0.2442 

-0.0052 

2.7267 

4.000 

0.650 

4.000 

4.2649 

3.4656 

2.8094 

0.2903 

0.0026 

2.8068 

4.000 

0.675 

4.000 

3.8245 

3.5557 

2.8994 

0.3370 

0.0116 

2.8878 

4.000 

0.700 

4.000 

3.4053 

3.6356 

2.9913 

0.3843 

0.0218 

2.9695 

4.000 

0.725 

4.000 

3.0071 

3.7058 

3.0848 

0.4320 

0.0332 

3.0516 

4.000 

0.750 

4.000 

2.6291 

3.7668 

3.1798 

0.4799 

0.0458 

3.1340 

4.000 

0.775 

4.000 

2.271 1 

3.8191 

3.2759 

0.5280 

0.0596 

3.2163 

4.000 

0.800 

4.000 

1.9323 

3.8632 

3.3730 

0.5760 

0.0746 

3.2984 

4.000 

0.825 

4.000 

1.6124 

3.8995 

3.4710 

0.6239 

0.0908 

3.3802 

4.000 

0.850 

4.000 

1.3107 

3.9285 

3.5695 

0.6716 

0.1082 

3.4614 

4.000 

0.875 

4.000 

1.0268 

3.9506 

3.6686 

0.7189 

0.1267 

3.5418 

4.000 

0.900 

4.000 

0.7601 

3.9663 

3.7679 

0.7658 

0.1465 

3.6215 

4.000 

0.925 

4.000 

0.5101 

3.9759 

3.8675 

0.8122 

0.1674 

3.7001 

4.000 

0.950 

4.000 

0.2761 

3.9799 

3.9670 

0.8579 

0. 1 894 

3.7776 

4.000 

0.975 

4.000 

0.0576 

3.9786 

4.0665 

0.903 1 

0.2125 

3.8539 

4.000 

1.000 

4.000 

-0.1458 

3.9724 

4.1657 

0.9475 

0.2368 

3.9289 

4.000 
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TABLE B-4. ELEVATOR STEP RESPONSE (concluded) 
Three Degrees of Freedom 


Time 

Airspeed 

change 

Long 

accel 

sec 

kt 

g 

-0.025 

0.00 

0.0000 

0.000 

0.00 

0.0000 

0.025 

0.00 

0.0000 

0.050 

0.00 

0.0001 

0.075 

0.00 

0.0001 

0.100 

0.00 

0.0002 

0.125 

0.00 

0.0003 

0.150 

0.00 

0.0004 

0.175 

0.00 

0.0005 

0.200 

0.00 

0.0007 

0.225 

0.00 

0.0008 

0.250 

0.00 

0.0009 

0.275 

0.00 

0.0010 

0.300 

0.00 

0.001 1 

0.325 

0.00 

0.0011 

0.350 

0.00 

0.0012 

0.375 

0.00 

0.0011 

0.400 

0.01 

0.001 1 

0.425 

0.01 

0.0009 

0.450 

0.01 

0.0008 

0.475 

0.01 

0.0005 

0.500 

0.01 

0.0003 

0.525 

0.01 

-0.0001 

0.550 

0.01 

-0.0004 

0.575 

0.01 

-0.0008 

0.600 

0.00 

-0.0012 

0.625 

0.00 

-0.0017 

0.650 

0.00 

-0.0022 

0.675 

0.00 

-0.0027 

0.700 

0.00 

-0.0032 

0.725 

0.00 

-0.0037 

0.750 

0.00 

-0.0043 

0.775 

-0.01 

-0.0049 

0.800 

-0,01 

-0.0055 

0.825 

-0.01 

-0.0061 

0.850 

-0.02 

-0.0068 

0.875 

-0.02 

-0.0075 

0.900 

-0.02 

-0.0082 

0.925 

-0.03 

-0.0089 

0.950 

-0.03 

-0.0096 

0.975 

-0.04 

-0.0103 

1.000 

-0.04 

-0.0111 


Normal 

accel 

g 

Airspeed 

kt 

Airspeed 

ratio 

0.0000 

282.25 

1.0000 

0.0000 

282.25 

1.0000 

-0.0004 

282.25 

1.0000 

-0.0016 

282.25 

1.0000 

-0.0035 

282.25 

1.0000 

-0.0061 

282.25 

1.0000 

-0.0090 

282.25 

1.0000 

-0.0123 

282.25 

1.0000 

-0.0157 

282.25 

1.0000 

-0.0190 

282.25 

1.0000 

-0.0221 

282.25 

1.0000 

-0.0247 

282.25 

1.0000 

-0.0266 

282.25 

1.0000 

-0.0277 

282.25 

1.0000 

-0.0279 

282.25 

1.0000 

-0.0268 

282.25 

1.0000 

-0.0245 

282.25 

1.0000 

-0.0209 

282.26 

1 .0000 

-0.0158 

282.26 

1 .0000 

-0.0093 

282.26 

1 .0000 

-0.0014 

282.26 

1 .0000 

0.0080 

282.26 

1.0000 

0.0183 

282.26 

1 .0000 

0.0290 

282.26 

1.0000 

0.0400 

282.26 

1.0000 

0.0514 

282.25 

1.0000 

0.0631 

282.25 

1.0000 

0.0750 

282.25 

1.0000 

0.0871 

282.25 

1.0000 

0.0993 

282.25 

1.0000 

0.1116 

282.25 

1.0000 

0.1240 

282.25 

1.0000 

0.1364 

282.24 

1.0000 

0.1488 

282.24 

1.0000 

0.1612 

282.24 

1.0000 

0.1735 

282.23 

0.9999 

0.1858 

282.23 

0.9999 

0.1979 

282.23 

0.9999 

0.2099 

282.22 

0.9999 

0.2217 

282.22 

0.9999 

0.2334 

282.21 

0.9999 

0.2449 

282.21 

0.9998 
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Flightpath response- The flightpath response is calculated next, because its bandwidth is wider 
(and its time scale shorter) than that of airspeed. To begin the calculation of flightpath response, the 
lift contributions from angle of attack and from elevator deflection are summed to obtain the total 
lift, and divided by weight to find the load factor L/W (point D). After subtracting the cosine of the 
flightpath angle yto form the normal acceleration (V/g) (dy/dt) (equation (B-2b)), the normal accel- 
eration is multiplied by g/V to obtain the flightpath rate dy/dt (point E). Finally, the flightpath rate 
is integrated using the Adams-Bashforth formula (B-18c) to obtain the flightpath angle y at time 
t = 0.025 sec (point F). To complete the calculation, the angle of attack a (point G) and angle-of- 
attack rate da/dt (point H) are updated to time t = 0.025 sec using equation (B-l): 

a, = 0, - y, (da/dt), = q, - (dy/dt), 

The wing (aerodynamic) angle of attack (point I) is found by subtracting the fixed wing incidence a* 
(table B-3) from the fuselage angle of attack a. This completes the calculation of the flightpath and 
angle-of-attack responses for time t = 0.025 sec. 

Airspeed response- The airspeed response is calculated last, because it has the narrowest 
bandwidth and the longest time-scale. The thrust is evaluated first. It is assumed for simplicity that 
the throttle setting and engine rpm are constant, so that thrust is a function of Mach number (or 
airspeed) and of altitude (eqs. (B-8d) and (B-8e)). Next, the lift coefficient is found from the load 
factor L/W calculated previously (eq. (B-6d)), the drag coefficient is found as a parabolic function of 
lift coefficient (eq. (B-7c)), and the dimensional drag force is found as a function of drag coefficient 
and airspeed (eq. (B-6d)). The excess thrust T - D is formed and divided by weight to obtain the 
quantity (T - D)/W (point J). After subtracting the sine of the flightpath angle yto form the normal- 
ized longitudinal acceleration ( 1/g) (dV/dt) (eq. (B-2a)), the latter quantity is multiplied by g to 
obtain the dimensional acceleration dV/dt (point K). Finally, the acceleration is integrated using 
the Adams-Bashforth formula (B-l 8c) to obtain the airspeed V at time t = 0.025 sec (point L). 

The airspeed ratio V/Vmd is now updated throughout the simulation using the airspeed at time 
t = 0.025 sec, completing the response calculations for the first time step. The results thus far are 
tabulated in the first three rows of table B-4. 

By repeating the entire calculation for 1 99 subsequent time steps, the first 5 sec of the response of 
the aircraft to the specified elevator step is tabulated. The calculations were performed in a few sec- 
onds by a Microsoft Excel 3.0 spread-sheet package running on a Macintosh llsi computer. The 
dynamic response of the aircraft to any other desired elevator control input could be calculated in a 
similar way. The resulting parameter variations are illustrated by figure B-l 1, which is discussed 
next. 

Aircraft Response Characteristics 

The dynamic response characteristics of the aircraft are presented in the form of time histories, 
that is, by the variations of the primary response variables with time. The variations of pitch rate, 
pitch angle, flightpath rate, flightpath angle, and angle of attack in response to a nose-up step in 
elevator deflection are illustrated by figures B-I 1(a) and B-l 1(c), and the associated variations of 
airspeeed relative to its initial value and of longitudinal and normal acceleration are illustrated by 
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Airspeed change, kt Angle, deg 


figure B-l 1(b). Figure B-l 1(d) shows the dynamic variation of flightpath angle with equivalent 
airspeed in the same form as that of the performance envelope of figure B-7. 



a) 


Three degrees of freedom 



Time, sec 


b) 

Figure B-1 1 . Elevator step response, 10 sec. 
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G units 


Flight path angle, deg Angle, deg 



C) 


Three degrees of freedom 



Equivalent airspeed, kt 

d) 

Figure B-1 1 . Elevator step response, 1 0 sec (concluded). 
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Elevator step response characteristics- It can be seen from figure B-l 1 that the angle-of-attack 
response (fig. B-l 1(a)) and the resulting normal acceleration (fig. B-l 1(b)) and flightpath angle rate 
(fig. B-l 1(a)) responses all have the same form as that of the initial step in elevator (fig. B-l 1(a)), 
but exhibit a time lag of about 1 .7 sec relative to the elevator control input. Therefore, elevator 
deflection commands normal acceleration. One of the oldest and most important flying qualities 
criteria specifies the pilot stick force per g. Desirable values are 6 lb/g for stick-equipped high- 
performance aircraft, and 30 to 40 lb/g for transport aircraft equipped with wheel and column. 

Figure B-l 1(a) shows that, after an initial transient of about 2.5 sec, pitch rate becomes equal to the 
(constant) flightpath angle rate. Therefore, elevator deflection commands pitch rate. Since both pitch 
angle and flightpath angle become parallel, steadily increasing ramp functions in the medium term 
after the initial transient, figure B-l 1(a) shows that flightpath angle can he controlled by means of 
pitch angle. During almost all flying, the fundamental control task is control of the flightpath; con- 
trol of the aircraft pointing attitude should be regarded as a means to that end. The exceptions are 
takeoff and landing, for which the attitude is important in itself to avoid scraping the tail or an 
engine nacelle, or landing on the nose gear. 

The lag of normal acceleration and flightpath rate relative to elevator deflection, which is inversely 
proportional to lift-curve slope, characterizes each aircraft. Since after integration the flightpath 
angle response exhibits the same lag relative to that of pitch angle, which is directly visible to the 
pilot, control of flightpath angle requires compensation by the pilot for this characteristic tag. The 
small initial reversal noticeable in the flightpath response (see the normal acceleration time history 
in figure B-l 1 (b)) results from the increase of tail download owing to elevator deflection, which 
reduces total lift. This reversal contributes to the total lag of the flightpath response relative to pitch, 
and can degrade the flying qualities of some transport aircraft configurations with small tail arms, 
especially during high-bandwidth maneuvers such as landing flare that require rapid response. To 
summarize, flightpath follows pitch with a time lag that characterizes the aircraft. 

At time t = 5 sec an equal and opposite elevator step is applied, which returns the elevator to the 
faired position (fig. B-l 1(a)). After the elevator control is neutralized, the pitching motion damps out 
smoothly without significant overshoot, and the pitch angle stabilizes in about 2 sec. In the long term 
after 7 sec, it can be seen that the aircraft holds the pitch attitude approximately constant. Therefore, 
neutral elevator commands constant pitch angle. 

These well-shaped, well-damped responses characterize transport aircraft considered to possess 
good flying qualities, which facilitate rapid, precise manual control of pitch attitude. These desirable 
response characteristics provide the motivation for rate command, attitude hold control augmenta- 
tion, which can be used to improve the flying qualities of aircraft not possessing desirable natural 
response characteristics. 

The substantial increase in flightpath angle relative to its initial equilibrium value produces negative 
longitudinal acceleration according to equation (B-2a), which is illustrated by the inverse correlation 
of longitudinal acceleration in figure B-l 1(b) with flightpath angle in figure B-l 1(a). This sustained 
longitudinal deceleration integrates to cause airspeed decay (fig. B-l 1(b)). The resulting lift loss 
(eq. (B-6(d)) produces the slight droop in pitch angle and flightpath angle visible in figure B-l 1(a) 
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for times after 7 sec. If the thrust were adjusted so as to hold airspeed fixed, the pitch angle and 
flightpath angle would remain constant in the long term (fig. B-l 1(c)). 

The variation of flightpath angle with equivalent airspeed during the first 10 sec is illustrated by 
figure B-l 1(d). It can be seen that the initial trajectory in the (V, y) plane is vertically upward in the 
short term, rounding over to the left in the medium term and becoming roughly horizontal in the 
long term. 

Figures B-l 2(a), (b), and (c) illustrate extension of the time histories of figure B-l 1 to include one 
minute of the response. The most striking feature of figure B-l 2 is the sustained long-period oscilla- 
tion of pitch angle, flightpath angle, and airspeed, which is termed the phugoid oscillatory mode. It 
can be seen from figure B-l 2(a) that the angle of attack remains nearly constant throughout the 
phugoid oscillation. 

The elevator steps of figures B- 1 1 and B- 1 2 are representative of large, coarse maneuvers such as 
glide-slope capture at the start of a landing approach. The small, precise modulations of flightpath 
angle needed for glide-slope tracking can be achieved by means of elevator pulses, which are 
discussed next, after presenting an interpretation of figures B-l 1 and B-l 2 from an alternative 
viewpoint. 


Three degrees of freedom 



Time, sec 

a) 

Figure B-12. Elevator step response, 60 sec. 
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Three degrees of freedom 
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Figure B-12. Elevator step response, 60 sec (concluded). 
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Frequency domain- In addition to the time-domain representation of the aircraft dynamical system 
made explicit by the block diagram of figure B- 10(a), there is a complementary frequency-domain 
representation that is discussed in this section. This frequency-domain representation provides an 
alternative view of aircraft dynamic response that should be of interest to readers familiar with sim- 
ple electrical filters, and also motivates the simplifications of the dynamic model to be discussed 
later. The discussion begins by simplifying the block diagram of figure B- 10(a). 

It can be seen from figure B- 10(a) that a forward path leads from the elevator control input to the 
pitch angle output. A direct path then continues from the pitch angle through the angle-of-attack 
feedback to the lift summation point marked ZL. When considering total lift, the pitch angle 
contribution to angle of attack can be regarded as a forward path contribution from elevator control, 
although the flightpath angle contribution to angle of attack is a feedback signal. The second 
contribution of elevator control to total lift via the tail download is much smaller than the wing lift 
contribution, and is neglected for simplicity in the present frequency-domain treatment. 

By representing only the forward path from the elevator control input to the pitch angle and then 
continuing to the flightpath angle and airspeed outputs, the dynamical system of figure B- 10(a) can 
be separated into its essential elements, as illustrated by the simplified diagram of figure B- 10(b). It 
can be seen that the forward path leading from the throttle control input through the engine model to 
its thrust output, and then to the airspeed output, has been treated in the same manner as elevator 
control. In figure B- 10(b), the same feedback structure as that in figure B- 10(a) is implicit. 

From the frequency-domain viewpoint, each of the elementary dynamical systems corresponding to 
the blocks in figure B- 10(b) can be regarded as a first or second order low-pass filter that acts on its 
input signal just as the corresponding electrical filter would, smoothing the input signal by filtering 
out its high-frequency components and imparting a characteristic time lag. Numerically, this 
characteristic lag is the time required for the exponential response to an abrupt, mathematically 
discontinuous input step to reach 63 percent of its steady-state value. As indicated on the diagram 
(fig. B- 10(b)), the second-order pitch filter has the widest bandwidth and the shortest lag, the first- 
order path filter and the second-order engine filter have intermediate bandwidth with a lag in the 
order of 2 sec, and the first-order airspeed filter has the narrowest bandwidth and the longest lag. 

The dynamic effects of these filters on the response to an elevator step can be seen in figures B-l 1 
and B-l 2, which have already been discussed from the time-domain perspective. Regarding the 
elevator deflection time history illustrated by figure B-l 1(a) as a long pulse formed by the two equal 
and opposite steps discussed previously, it can be seen from figure B-l 1(a) that the pitch filter 
smooths this elevator pulse and extends its time duration, with a characteristic overshoot of the 
steady-state value and a heavily damped oscillation that results from its second-order nature. The 
path filter then acts on the pitch angle input signal, smoothing it heavily to generate the flightpath 
angle signal. The overshoot in the pitch-angle signal is filtered out, but serves to quicken the flight- 
path response so as to make its lag relative to pitch less noticeable than it would be in the absence of 
pitch overshoot. 

The first-order speed filter then acts on the flightpath angle signal to generate the airspeed signal 
(fig. B-1 1(b)). The airspeed signal is smoothed too heavily for its dynamics to be visible on the short 
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time-scale of figure B-l 1(b), but the long-period phugoid oscillation seen in figure B-12 results from 
the long lag of the speed filter, which couples dynamically with the pitch filter and the path filter by 
means of the implicit feedback paths to generate the phugoid oscillation. 

The same kind of frequency-domain analysis could be applied to the response of the aircraft to a 
short elevator pulse, which is discussed in the next section from the time-domain perspective. The 
frequency-domain viewpoint is addressed again later to enable further simplifications of the dynamic 
model. 

Elevator pulse response at airspeeds above the speed for minimum drag- The first 5 sec of the 
response to a short ( 1 sec) 1 -deg elevator pulse that pitches the aircraft nose-down is illustrated by 
figure B-l 3. The figure shows that, in the medium term after 2.5 sec, both pitch angle and flightpath 
angle remain constant after decreasing by about 1/4 deg relative to their initial values. This 1-deg 
elevator pulse is representative of the control inputs required to achieve small, precise changes in 
flightpath angle during high-precision tasks such as glide-slope tracking. The associated airspeed 
increase (fig. B-l 3(b)) is too small for the resulting lift increase to affect the pitch angle, flightpath 
angle, and angle-of-attack responses seen in figure B- 1 3(a). 


Three degrees of freedom 



a) 

Figure B-13. Elevator pulse response, 5 sec. 
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Three degrees of freedom 



b) 

Figure B-13. Elevator pulse response, 5 sec (concluded). 


However, extending the time histories of figure B-13 to include 60 sec of response, as illustrated by 
figure B-14, reveals the characteristic phugoid oscillation seen previously in figure B-12. Pilots 
suppress this phugoid oscillation by applying elevator control so as to stabilize pitch angle. This 
pilot control input can be approximated by holding pitch angle fixed for all times after 4.65 sec, as 
illustrated by figure B-15. (The time 4.65 sec was selected by choosing a time before the phugoid 
response has developed significantly, and for which the pitch rate vanishes.) It can be seen from 
figure B- 15(a) that stabilizing the pitch angle completely suppresses the phugoid oscillation. As the 
airspeed increases because of the sustained longitudinal acceleration resulting from the decrease in 
flightpath angle (fig. B- 15(b)), the long-term increase in lift causes the flightpath angle to increase 
(fig. B- 15(a)). With pitch fixed, the angle of attack decreases, reducing lift until the decreased lift 
resulting from the angle of attack decrease equilibrates the increased lift resulting from the airspeed 
increase. In the long term, it can be seen that the flight condition becomes stable, with the aircraft in 
equilibrium at the higher airspeed. It should be noted from figure B- 15(a) that, with pitch stabilized, 
most of the initial flightpath increment is destroyed by the long-term response, almost nulling the 
effect of the control input. 
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Figure B-14. Elevator pulse response, 60 sec. 
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Figure B-1 5. Elevator pulse response, 1 1 5 sec, 0 fixed after 4.65 sec, V > V M in drag- 
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Figure B-15. Elevator pulse response, 115 sec, 0 fixed after 4.65 sec, V > Vmindrag (concluded). 


If the pitch angle is controlled so as to maintain this flightpath increment fixed, the response of the 
aircraft is illustrated by figure B-16. The figure shows that, in the medium and long term after time 
2.7 sec (selected for vanishing flightpath rate), the flightpath angle remains fixed. Figure B- 16(a) 
shows that a slow decrease in angle of attack is required to hold flightpath angle fixed. With path 
angle fixed, the time history of pitch angle (not illustrated) has the same form as that of angle of 
attack. Again the aircraft stabilizes in the long term just as for fixed pitch (compare figure B-15), 
although a much longer time is required to reach equilibrium. (The very long 10-sec integration step 
used after time 5 sec was selected for computational convenience in the spread-sheet implementa- 
tion. With these smooth functions, trials with shorter steps showed no significant error owing to the 
long step, and in any case, the final equilibrium condition is independent of the trajectory by which 
it is reached.) The variation of flightpath angle with airspeed illustrated by figure B- 16(c) consists of 
an initial vertical segment and a final horizontal segment without visible rounding, a consequence of 
the effect of the large airspeed change on the scaling of the abscissa. 


B-58 


Airspeed change, kt 


Flightpath angle fixed after 2.7 sec 


CD 

0) 

T2 

6 

o> 

c 

< 


2.0000 


1.5000 


1.0000 


0.5000 




0 - 


-0.5000 * ^ 

0 


10 sec integration step 


J I t « i l 1 L 

500.000 1000.000 


Flightpath angle 

Angle of attack 


Angle of 
attack 
stable 


i \ i i i i i i i i i i 

1500.000 2000.000 2500.000 


Time, sec 

a) 


Flightpath angle fixed after 2.7 sec 



b) 

Figure B-16. Elevator pulse response, 2205 sec, y fixed after 2.7 sec, V > V M indrag- 
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Figure B-16. Elevator pulse response, 2205 sec, y fixed after 2.7 sec, V > V M | NDRAG (concluded). 


For fixed flightpath angle (horizontal segment of figure B- 16(c)) lift is equal to aircraft weight 
(eq. (B-2b)), so that the normal forces are in equilibrium during the whole time after the path is fixed 
at 2.7 sec. The longitudinal acceleration resulting initially from the decrease in flightpath angle is 
sustained until it is equilibrated by the increase of parasite drag owing to the airspeed increase 
(fig. B- 16(b)). The airspeed increase required to reach equilibrium of the longitudinal forces can be 
determined from the performance envelope, such as that illustrated by figure B-7. The point of final 
equilibrium is defined by the intersection of the appropriate constant-rpm contour with the horizon- 
tal line corresponding to the fixed flightpath angle. To summarize, figure B-16 shows that, in the 
region above the speed for minimum drag, the flightpath can be controlled by means of pitch control 
alone, with thrust setting (rpm) fixed. It is otherwise below the speed for minimum drag. 

Elevator pulse response at airspeeds below the speed for minimum drag- If the elevator pulse 
is reversed in sign so that the aircraft pitches nose-up, its response with pitch fixed after 4.65 sec is 
illustrated by figure B-17. It can be seen that, after accounting for the elevator sign reversal, the 
response is similar in form to that for the nose-down elevator pulse (compare figure B- 15). In 
particular, figure B-17 shows that, with pitch fixed, the aircraft stabilizes in the long term at an 
airspeed slightly below the speed for minimum drag. 
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Figure B-17 Elevator pulse response, 1 15 sec, 0 fixed after 4.65 sec, V < Vmindrag- 
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Figure B-17 Elevator pulse response, 115 sec, 6 fixed after 4.65 sec, V < Vmindrag (concluded). 


In contrast, if pitch is controlled so as to hold the flightpath angle fixed after 2.7 sec, the response of 
the aircraft is illustrated by figure B-18. It can be seen that the aircraft never reaches a stable equi- 
librium of longitudinal forces. The longitudinal deceleration owing to the initial increase in flight- 
path angle is sustained by the contribution of induced drag, which as previously noted increases with 
decreasing airspeed (fig. B- 18(b)). The result is that, with both flightpath angle and thrust setting 
held fixed below the speed for minimum drag, the airspeed decreases (fig. B- 16(b)) and the angle of 
attack increases (fig. B-16(a)) until the aircraft stalls. The time history of the pitch angle required to 
hold the flightpath fixed (not illustrated) has the same form as that of angle of attack (fig. B- 16(a)). 
The important conclusion is that, below the speed for minimum drag , the flightpath angle cannot be 
controlled by means of pitch control alone with thrust setting fixed. 

By making thrust adjustments that compensate for the increase of induced drag (eq. (B-2a)), the air- 
craft can be stabilized at a target (V, y) operating point below the speed for minimum drag. On the 
performance envelope chart of figure B-7, such a target operating point is defined by the intersection 
of the horizontal line corresponding to the selected flightpath angle with the vertical line correspond- 
ing to the selected airspeed. It can be shown that, below the speed for minimum drag, such points are 
points of unstable equilibrium. To verify this property, note that displacement to a slightly lower 
airspeed by some disturbance would result in airspeed divergence to the stall, just as that illustrated 
by figure B-18. Therefore, below the speed for minimum drag, active control of thrust is required for 
stability , with significantly increased pilot workload during manual control. 
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Figure B-18. Elevator pulse response, 885 sec, y fixed after 2.7 sec, V > V M in drag- 
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Figure B- 18 . Elevator pulse response, 885 sec, y fixed after 2.7 sec, V > Vmindrag (concluded). 


The pilot technique actually used for glide-slope tracking below the speed for minimum drag, such 
as for aircraft carrier landing approach, can be discussed by referring to the performance envelope 
chart of figure B-7. It can be seen that any target operating point can be defined by the intersection 
of the contour corresponding to the selected thrust setting (rpm) with that corresponding to the 
selected pitch angle. Since all points within the performance envelope are points of equilibrium, the 
forms of these contours imply that, in the long term, flightpath angle can be controlled by means of 
thrust. If flightpath angle is varied by 1/4-deg increments for glide-slope tracking by adjusting thrust, 
while pitch angle is held fixed, then figure B-7 shows that the resulting airspeed excursions are small 
in the long term. These small airspeed excursions can be controlled as necessary by adjusting pitch, 
and the time histories of figure B-17 show that the resulting response is stable. In practice, pitch 
control is coordinated with thrust in order to obtain more rapid flightpath response than that resulting 
from thrust modulation alone. 


Pilots often refer to the airspeed region below the speed for minimum drag, in which total drag is 
dominated by the induced drag contribution, as the “back side of the drag curve,” and to the control 
of flightpath angle by means of thrust and control of airspeed and angle of attack by means of pitch 
as “back-side technique.” The region below the speed for minimum drag is also termed the region of 
reversed command, since above that speed path is controlled with pitch and speed with thrust, as 
already discussed. In order to limit the increase in pilot workload required for thrust coordination 
below the speed for minimum drag, flying qualities criteria for manual control specify the maximum 
slope (that is, dy/dV) of the constant-rpm contours in the neighborhood of the target operating point 
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(fig. B-7). Pilot workload can be reduced significantly by means of an autothrottle. The characteris- 
tic differences in dynamic response above and below the speed for minimum drag just discussed for 
manual control also have fundamental significance for the choice of feedback loop structure within 
such automated systems. 

Automated control systems- In particular, referring to the three primitive control modes discussed 
in the main report, the loop structure chosen for the y-V Command mode feeds back path error to 
pitch control and speed error to thrust control. In the y-V Command mode, active thrust control 
enables stability to be achieved both above and below the speed for minimum drag. If the thrust 
saturates so that active thrust control is no longer available, then the y-V Command mode is invalid, 
and one of the other two primitive modes must be selected. 

The loop structure chosen for the V Command mode feeds back speed error to pitch control, while 
thrust (rpm) remains fixed. The resulting response is qualitatively similar to that illustrated by 
figures B-15 and B-17, so that the V Command mode is stable both above and below the speed for 
minimum drag, although the path is not constrained. 

The other primitive mode available when thrust is saturated is the y Command mode, which feeds 
back path error to pitch control while thrust remains fixed. Above the speed for minimum drag, the 
resulting response is qualitatively similar to that of figure B- 1 6, so that the y Command mode is 
stable, although speed is not constrained. Below the speed for minimum drag, the response in the 
y Command mode is qualitatively similar to that of figure B-18. It has already been noted that this 
response is unstable. If the y Command mode were engaged below the speed for minimum drag, the 
resulting airspeed divergence could lead to a potentially catastrophic stall. Therefore,. flight safety 
requires that the associated mode selection logic must prevent its engagement under these invalid 
conditions. It is clear that the dynamical behavior illustrated by figures B-15, B-16, B-17, and B-18 
is of fundamental importance for the design of automated control systems. 

Simplified Models 

The remaining task is the development of simplified dynamic models; simplification is facilitated by 
returning to the frequency-domain viewpoint discussed previously. Since the three filters for pitch, 
path, and speed illustrated by figure B- 10(b) act in cascade, the bandwidth of the response signal at 
any point in the diagram is dominated by the bandwidth of the lowest-bandwidth filter upstream of 
that point. Stating the same property in time-domain terms, the high-frequency fluctuations present 
in the pitch angle signal at the output of the pitch filter are not observable in the flightpath response, 
because these high-frequency details are filtered out by the heavy smoothing of the path filter that 
lies immediately downstream of the pitch filter. Similarly, intermediate-frequency fluctuations 
present in the flightpath signal at the output of the path filter are not observable in the airspeed 
signal, because they are filtered out by the extremely heavy smoothing of the speed filter. These 
summary statements are justified by the detailed discussion of the time histories of figures B-l 1 and 
B-12 presented previously. 

Two-Degree-of-Freedom Model 

It follows that little change in the flightpath and airspeed signals would result if the pitch angle 
signal were drastically simplified. For the aircraft response to the short nose-up elevator pulse illus- 
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trated by figure B- 13(a), if the details of the pitch overshoot and oscillation are neglected, the pitch 
response can be approximated by a pitch step shaped by a cosine bell. It was pointed out previously 
that the pilot shapes the elevator control input so as to obtain just such a pitch response, thereby 
enabling small, precise changes in flightpath angle in the medium term and suppressing the phugoid 
oscillation in the long term. If the pitch angle thus specified is regarded as the control input, then 
the dynamical system can be represented by the two-degree-of-freedom model illustrated by the 
simplified block diagram of figure B- 10(c). (Throttle control, which is not treated in the examples 
selected for this appendix, would add another degree of freedom for thrust, so that the system of 
figure B- 10(c) would have a total of three degrees of freedom.) The response of this two-degree- 
of-freedom model to the nose-up elevator pulse of figure B- 13(a) is illustrated by figures B-19 
and B-20. 

Pitch step response - In figure B- 19(a), the actual pitch time history of figure B- 13(a) is approxi- 
mated by a step shaped by a 0.5-sec cosine bell. The magnitude of this pitch step is chosen so that 
the initial pitch angle and that at time 4.65 sec coincide on the two charts. It can be seen that the two 
pitch-angle time histories are nearly coincident over the medium term after 3 sec. Furthermore, the 
angle of attack responses seen in the two charts also match fairly well in the medium term. The two 
flightpath-angle responses match fairly well over the whole 5-sec interval, with errors that do not 
exceed about 0. 1 deg anywhere. Comparison of figure B- 19(b) with figure B- 13(b) shows that the 
longitudinal acceleration and airspeed responses match very well over the whole 5-sec interval (note 
the expanded airspeed scale). 


Two degrees of freedom 



Figure B-19. Pitch step response, 5 sec, two degrees of freedom. 
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Figure B-19. Pitch step response, 5 sec, two degrees of freedom (concluded). 


When the time interval is extended to 1 15 sec, comparison of figure B-20(a) with figure B- 15(a) 
shows that, in the medium and long term after 5 sec, the two-degree-of-freedom approximation is 
nearly exact for both angle of attack and flightpath angle. Comparison of figure B-20(b) with 
figure B- 15(b) shows that the same is true for longitudinal acceleration and airspeed. Therefore , if 
one is interested chiefly in the flightpath angle and airspeed responses to pitch control, it is evident 
that the two-degree-of-freedom model will serve very welt. 

Discussion- In particular, this demonstration justifies use of the two-degree-of-freedom approxima- 
tion for the analysis of mode validity discussed in the main report. For the control system described 
there, the y Command mode corresponds to control of flightpath angle by means of elevator control 
with fixed throttle setting, and the V Command mode corresponds to control of airspeed by means 
of elevator control with fixed throttle setting. It has just been demonstrated that, with fixed throttle 
setting, both flightpath angle and airspeed responses to elevator control can be approximated satis- 
factorily by the two-degree-of-freedom model, which replaces specification of the form of the 
elevator control time history with specification of the resulting medium-term and long-term pitch 
response. The two-degree-of-freedom approximation is therefore valid for both the y Command and 
the V Command modes. 
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Figure B-20. Pitch step response, 1 15 sec, two degrees of freedom. 
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In a similar way, the two-degree-of-freedom model can be extended to include control of both 
flightpath angle and airspeed by simultaneous elevator and throttle control, which corresponds to the 
y-V Command mode. This extension is accomplished by replacing specification of the form of the 
throttle control time history with specification of the resulting medium-term and long-term thrust 
response generated by the engine model. Because the dynamic thrust lag within the engine model 
has a narrower bandwidth and a longer time scale than that of the pitch response to elevator deflec- 
tion, it follows that neglect of thrust dynamics presents a less critical challenge to validity of the 
two-degree-of-freedom model than does the neglect of pitch dynamics already demonstrated. 

One-Degree-of-Freedom Model 

If flightpath angle is controlled by means of pitch (that is, elevator deflection) and thrust is con- 
trolled by means of throttle so that the forms of both the flightpath angle and thrust time histories are 
specified, then the airspeed response can be approximated by making use of the one-degree-of- 
freedom model illustrated by figure B-10(d). This drastically simplified model, which neglects the 
dynamics of pitch, flightpath, and thrust, nevertheless retains the important quadratic nonlinearity 
resulting from the variation of drag with speed. 

Path step response- To specify the flightpath angle time history for the single-degree-of-freedom 
model, the flightpath angle step is shaped by a 2-sec cosine bell that approximates the flightpath lag 
relative to elevator deflection (fig. B- 13(a)). The resulting responses of longitudinal acceleration 
and airspeed are illustrated by figures B-21(a) and B-2 1(b). Comparison of figure B-21(a) with 
figure B- 13(b) shows that the single-degree-of-freedom approximation provides a nearly exact 
match of the two time histories during the first 5 sec, and comparison of figure B-21(b) with 
figure B- 16(b) shows that this excellent agreement extends over the long term. Since the engine 
thrust lag (figs. B-5 and B-6) is of the same order as that of the flightpath response (fig. B-10(b)), 
the thrust input for figure B-10(d) could be specified in a similar manner by shaping a thrust step of 
the desired magnitude with a 2-sec cosine bell to approximate the engine thrust lag. It is clear that, 
if one is interested chiefly in the airspeed response to flightpath angle and thrust control , the single- 
degree-of-freedom model will serve very well. This somewhat surprising result reduces the entire 
aircraft model to a very simple dynamical system governed by the nonlinear differential equation 
(B-2a) for longitudinal forces, which can be solved numerically by a single integration for each 
time step. 
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Figure B-21 . Path step response, 5 sec and long term, single degree of freedom. 
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APPENDIX C 

SYMMETRIC (COORDINATED) TURNING FLIGHT 


This appendix generalizes the longitudinal equations of motion for symmetric (coordinated) turning 
flight, in order to provide results needed for the main report. The main report uses the two-degree- 
of-freedom model presented in appendix B, which eliminates the pitching moment equation from 
the dynamic model by the assumption of effectively infinite pitch bandwidth and control power. 
Therefore, only the two longitudinal force equations require generalization for turning flight. 

In order to achieve a concise but rigorous treatment, the development that follows makes extensive 
use of vector/matrix methods, and limited use of spherical trigonometry. It will be shown that, for 
straight wings-level flight, the generalized equations reduce to those already obtained (app. B) by 
elementary methods. The aircraft structural, aerodynamic, and propulsive models, together with 
those for the Earth and the atmospheric environment, remain the same as those discussed in 
appendix B. For the generalized treatment that follows, flight is assumed to take place in still air. 


GENERAL VECTOR FORCE EQUATION 

The equation of motion for a rigid aircraft subject to aerodynamic, propulsive, and gravitational 
forces is obtained directly in vector form from Newton's second law: 

m a path = F aero + F pr,,p + F srav (C- 1 ) 

where m denotes the aircraft mass, a its kinematic acceleration, and F the external force acting on 
the aircraft. The superscripts indicate the nature of each force, and the subscript indicates the 
reference frame in which each quantity is described. In equation (C-l ), the path-frame components 
of the aerodynamic and propulsive forces are the lift L, the drag D, the side force Y, and the thrust T, 
as discussed previously (app. B). The path-frame components of the aircraft weight W must be 
found by trigonometric resolution. To accomplish this task, the spatial orientation of the path frame 
can be specified relative to the Earth by defining three Eulerian angles. 

Eulerian Angles for Path Frame 

These three Eulerian angles are defined as follows (fig. C-l). The process starts with the orthogonal 
right-handed local Earth frame NED (that is, the directions North, East, and Down) with its origin 
fixed at the aircraft center of gravity. The frame X" Y" Z" is generated by positive rotation about the 
D axis through the aircraft track angle ij/ T (fig. C-l (a)). It can be seen that the Z" axis coincides with 
the D axis. Next, the frame X' Y' 7! is generated by positive rotation about the Y axis through the 
aircraft flightpath angle y(fig- C-l(b)). It can be seen that the Y' axis coincides with the Y" axis. 
Finally, the path frame T L N (that is, the tangent direction along the aircraft velocity vector, the 
normal to the velocity vector in the negative lift direction, and the lateral axis in the direction of the 
side force) is generated by positive rotation about the X' axis through the roll angle (J/ (fig. C-l(c)). 
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a) Definition of track angle vj/ T . b) Definition of flightpath angle y. c) Definition of roll angle <)>'. 

Figure C-1 . Spatial orientation of path frame. 


It can be seen that the T axis coincides with the X' axis. The N axis is taken as the negative lift 
direction in order to preserve the right-handedness of the path frame. 

Weight Components 

With the Eulerian angles \)/t, y, and 4>' specified, the path-frame components of the aircraft weight W 
are given by the matrix equation 

[w T W L W J T =[4 > , Hy][v t ] [o o w] T (C-2) 

In equation (C-2). the direction cosine matrices [i|/t], ly], and )<))'] are specified by symmetric nine- 
element arrays as follows: 


(¥,■] = 


COS V|/ T 

-sin \\i r 
0 


sin Vj/ T 0 

cos V|/. r 0 

0 1 



cos y 

0 

-sin y 

[y] = 

0 

1 

0 


sin y 

0 

cos y 


"l 

0 

0 


[<)>'] = 0 cos (J)' sin (J)' 
0 — sin (j)' cost))' 


(C-2a) 


(C-2b) 


(C-2c) 
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In equation (C-2), the first matrix multiplication yields 


[l|/ T ][0 0 W] T =[0 0 W] T (C-2d) 

Equation (C-2d) shows that, because the i|/j rotation is taken about the D axis, which coincides with 
the direction of the gravity vector, the path-frame components of the weight vector are independent 
of the aircraft track direction \|/ T . Therefore, the track angle can be taken as North (that is, vj/t = 0) 
without loss of generality. With equation (C-2d), equation (C-2) becomes 

[W T W L W N ] T =[4) r ][y] [0 0 W] T (C-2e) 


The indicated matrix multiplication on the right side of equation (C-2e) results in the product 


[f][y] = 


cos y 

sin 4 / sin y 
cos <J/ sin y 


0 

COS 4 / 

- sin 4 / 


-sin y 
sin 4 > r cos y 
cos 4 >' cos y 


(C-2f) 


With equation (C-2f), the path-frame components of the weight W are found from equation (C-2e) 
to be 

[W T W N J T =W[-sinY sin 4> r cosy cos 4>" cosy ] 1 (C-2g) 

After substituting equation (C-2g) and putting m = W/g, equation (C-l) becomes, in matrix form, 

(W/g)[a T a L aJ T =[-D Y -L] TaerK 

+ [T 0 0] T prop 

+ W [-sin Y sin 4>' cos Y cos 4 / sin y] 1 grav 


or, combining terms and dividing by W, 


d / g)[ a T a L aJ T 

= [(T - D)/W -sin y) (YAV + sin 4> / cos Y) (-LAV + cos 4>’ cos y] 1 


(C-3) 


Kinematic Acceleration Components 

The next task is to calculate the path-frame components of the kinematic acceleration a on the left 
side of equation (C-3). In general, the path frame rotates with respect to the Earth with an angular 
velocity that is denoted by to. Since by assumption the Earth frame is inertial, the path frame rotates 
with angular velocity to relative to inertial space. In such a rotating frame, the kinematic acceleration 
a is given by the well-known formula for vector differentiation of velocity (Wills, 1958; Etkin, 

1959; McRuer, Ashkenas, and Graham, 1973): 
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a = dV/dt = SV/8t + (o x V 


(C-4) 


where dV/dt denotes the time derivative of the velocity vector V measured in the inertial (Earth) 
frame, and 8V/8t denotes the time derivative of the scalar magnitude V measured in the path frame. 
Equation (C-4) has the physical interpretation that, at constant speed, the 5V/5t term vanishes, but 
the centripetal acceleration owing to curvature of the flightpath is accounted for by the vector cross- 
product term co x V. 

In equation (C-4), the total angular velocity co is found by vectorial summation of the Eulerian 
angular rates dl|/ T /dt, dy/dt, and d<J>Vdt. This summation is complicated by the fact that the axes about 
which the Eulerian rotations V|/ T , y, and 4>' are taken are not, in general, orthogonal (fig. (C-l)). It 
follows from the definitions of these angles that the path-frame components of the angular velocity 
vector to are given by the matrix equation 

[co T co, co n ] t = [d<|>7dt 0 0] T +[(t>']{[0 dy/dt 0] T +[y][0 0 d\|/ T /dt] T } 

or (C-5) 

1®T ®L “n1 T 

= [d(J)7dt 0 0 ) T +[f](0 dy/dt 0] T +[f)[y][0 0 dv./dt] 1 

After carrying out the indicated matrix multiplications on the right side of equation (C-5), the path- 
frame components of the angular velocity vector co are found to be 

[co T co, co n ] 1 =[(d<|)7dt — dvp T /dt sin y) (dy/dt cos 4 /+ dv|/ T /dt sin <()' cos y) 

(-dy/dt sin (J)' -t- d\}/ T /dt cos 4/ cos y)] 1 (C-5a) 


In equation (C-4), the path-frame components of the 8V/5t term on the right are given by 

8V/8t = [8V/8t 0 0] T (C-5b) 

With equations (C-5a) and (C-5b), equation (C-4) becomes 


a T 


(dV/dt) 

U L 

= 

(— V dy/dt sin (j)' + V d\j/ T /dt cos cos y) 

_v 


(—V dy/dt cos 4/ - V dv|/ T /dt sin 4>" cos y) 


(C-5c) 


All the elements of the path-frame longitudinal force equations have now been found. After 
substituting equation (C-5c) into the left side of equation (C-3), the general vector equation of 
motion becomes 
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1 

(dV/dt) 


(T - D)/ W - sin 7) 

1 

(— V dy/dt sin 4 > r + V dvj/ T /dt cos 4 >' cos 7) 

= 

(Y / W + sin 4/ cos 7) 

§ 

( — V dy/dt cos 4/ - V di|/ T /dt sin 4/ cos 7) 


(-L / W + cos 4/ cos y) 


When expressed in scalar form, the vector equation (C-6) is equivalent to three scalar equations for 
longitudinal (streamwise) force, side force, and normal force (lift): 


( 1 /g) [(dV/dt) 

(V/g) dy/dt sin 4/ + ( V/g) dv[/ T /dt cos 4/ cos 7 
(V/g) d 7 /dt cos 4 >" - (V/g) dV(/ T /dt sin 4/ cos 7 


(T - D)/W - sin 7 

(C-6a) 

Y/W -1- sin 4/ cos 7 

(C-6b) 

- L/W + cos 4/ cos 7 

(C-6c) 


COORDINATED TURNING FLIGHT 

In coordinated (symmetric) turning flight, the side force Y vanishes. After imposing this condition, 
equation (C-6b) can be solved for the quantity (V/g) di|/ T /dt to obtain 

(V/g) dv|/ T /dt cos 4 >' cos 7 = sin 4 >’ cos 7 + (V/g) d7/dt sin 4 >' 
or 

(V/g) d\|/ T /dt = tan 4/ + (V/g) dy/dt tan 4>Vcos y (C- 7 a) 

In level flight, or in a steady climb or descent, the flightpath rate dy/dt vanishes, and the turn rate 
equation (C- 7 a) reduces to a well-known formula for a steady coordinated turn: 

( V/g) d\|/ T /dt = tan cf) r (C- 7 b) 

Returning to the general coordinated turn, the quantity (V/g) dv|/-r/dt can be eliminated from the lift 
equation (C- 6 c) by substituting equation (C- 7 a). After simplifying with the help of the identity 
1 /cos 2 4/ = 1 + tan 2 4 > , the lift equation for the coordinated turn is finally obtained: 

(V/g) dy/dt + cos 7 = (L/ W) cos 4/ (C- 7 c) 

The longitudinal (streamwise) force equation (C-6a) can be written 

( 1 /g) (dV/dt) + sin 7 = (T- D)/ W (C- 7 d) 

It should be noted that the streamwise force equation (C- 7 d) holds in general, but the lift equation 
(C- 7 c) is restricted to coordinated flight. 
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By comparing equation (C-7c) with equation (B-2b) (app. B), and comparing equation (C-7d) with 
equation (B-2a) (app. B), it can be seen that, for wings-level flight (that is, (j)' = 0), the generalized 
equations reduce to those obtained previously by elementary methods. (As noted in appendix B, for 
llight in still air the inertial velocity and inertial flightpath angle coincide with their airmass 
counterparts.) 


KINEMATIC EQUATIONS FOR COORDINATED TURNING FLIGHT 

Although equation (C-7c) is exact, it involves the roll angle (J)' taken about the velocity vector 
(fig. C-l(c)). This definition of the roll angle differs from the conventional one, which takes the roll 
rotation about the longitudinal fuselage axis (that is, the X axis of the body frame). It will be shown 
that, in coordinated (symmetric) llight, the direction of the fuselage axis differs from that of the 
velocity vector by the angle of attack a. Therefore, for small angles of attack, it is immediately 
obvious that the lift equation (C-7c) holds approximately if the roll angle <j)' taken about the velocity 
vector is replaced by the conventionally defined bank angle <]) taken about the fuselage axis. The 
region of validity of this approximation can be determined by finding the exact relation between the 
two roll angles 4 / and ()). This problem is considered next. 

Eulerian Angles for Body Frame 

The first task is to specify the spatial orientation of the body frame, which can be achieved by 
defining the Eulerian aircraft heading angle 4 /, the pitch angle 0, and the bank angle (|) (fig. C-2). It 
can be seen that the aircraft heading angle y specifies the azimuth direction relative to north of the 
projection of the fuselage axis X onto the horizontal plane (fig. C-2), while the track angle yr 
defined previously specifies the direction of the horizontal projection of the aircraft velocity vector 
(fig. C-l). 

Starting from the Earth frame N E D as before, the frame X" Y" Z" is generated by positive rotation 
about the D axis through the heading angle y (fig. C-2(a)). It can be seen that the Z" axis coincides 
with the D axis. Next, the frame X' Y' Z' is generated by positive rotation about the Y" axis through 



a) Definition of heading angle y. b) Definition of pitch angle 0. c) Definition of bank angle 0. 

Figure C-2. Spatial orientation of body frame. 
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the pitch angle 0 (fig. C-2(b)). It can be seen that the Y' axis coincides with the Y" axis. Finally, 
the body frame X Y Z is generated by positive rotation about the X' axis through the roll angle <}) 
(the conventionally defined bank angle). It can be seen that the fuselage axis X coincides with the 
X' axis. To summarize, the body frame is related to the Earth frame by the Eulerian angles V| /, 0, and 
<j) (fig. C-2), and the path frame is related to the Earth frame by the angles \|/t, y, and (j>' (fig. C-l ). 

The path frame is related to the body frame by the angle of attack a and the angle of sideslip (3 
(fig. C-3(a)). It can be seen from figure C-3(a) that the body-axis velocity components u, v, w are 
related to the total velocity V by the equations 


In coordinated flight, the sideslip angle (3 vanishes together with the side force Y because of the 
assumed aerodynamic and propulsive bilateral symmetry (app. B), so that the velocity vector lies in 
the body-frame plane of symmetry X Z (fig. C-3(a)). It can be seen that, in the plane of symmetry, 
the projection of the velocity vector intersects the fuselage axis in the angle of attack a, as stated 
previously. 


The relationship of the body frame to the path frame in coordinated flight is illustrated by 
figure C-3(b), which depicts the surface of the sphere of unit radius whose origin lies at the aircraft 
center of gravity. The North direction N intersects the spherical surface at point D, the gravitational 
vertical -D intersects it at point A, the aircraft velocity vector T intersects it at point B, and the 
fuselage axis X intersects it at point C. The horizontal plane cuts the sphere in arc DE. The vertical 
plane containing the velocity vector T cuts the sphere in arc ABD, and that containing the fuselage 
axis cuts it in arc ACE. The two vertical planes are orthogonal to the horizontal plane, so that the 
angles ADE and AED are right angles. The aircraft plane of symmetry contains both its fuselage 

Plane of symmetry X -D 


u = V cos (3 cos a 
v = V sin (3 
w = V cos (3 sin a 


(C-8) 


Kinematic Relationships 



N 

b) Relation of body frame to path frame in 
symmetric (coordinated) flight. 


T 


a) Definition of angle of attack a and angle of 
sideslip (3. 


Figure C-3. Orientation of body frame to path frame. 
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axis X and its velocity vector T, and cuts the sphere in the arc BC, which by definition (fig. C-3(a)) 
measures the angle of attack a. Since all these planes contain the origin, their intersecting arcs are 
therefore great-circle arcs. In figure C-3(b), the direction of the aircraft track is north, so that V|/ T = 0. 
Its heading angle V|/ coincides with the angle CAD, and is measured by the arc DE. Its pitch angle 0 is 
measured by the arc CE, and its flightpath angle y by the arc BD. The roll angle <jf about the velocity 
vector T and the bank angle 0 about the fuselage axis X are illustrated by figure C-3(b). The pilot, of 
course, observes these relationships from inside the sphere. 

Instead of multiplying out the direction-cosine matrices as done previously in deriving equation 
(C-6), the desired relation between the roll angle 4>' and the bank angle $ will be obtained in a 
simpler way by making use of spherical trigonometry. In the spherical triangle ABC, the angles A, B, 
and C and the opposite sides a, b, and c can be identified as follows (fig. C-3(b)): 

A = V | ) B = <|)' C = 7t — <J) 

a = a b = k/2 - 0 c = k/2 - y 

The law of sines gives immediately the relations 

sin A/sin a = sin B/sin b = sin C/sin c 


(C-9) 


(C-9a) 


After substituting the identities (C-9), the second equality (C-9a) becomes 

sin <j)7sin (n/2 - 0) = sin (7t — (f>)/ sin (k/2 -y) 


which reduces to 


sin <|)7cos 0 = sin (|)/cos y 


or, finally. 


sin (j)' = (cos 0/cos y) sin ()) (C-9b) 

Equation (C-9b) is exact, and holds for coordinated flight without restriction to first-quadrant angles. 
It gives the desired relationship between the two roll angles and 0 for coordinated flight. 

Another exact relationship between 0. y, a. and ((> can be obtained from the law of cosines for side c 
of the spherical triangle ABC: 


cos c = cos a cos b + sin a sin b cos C (C-9c) 

Upon substituting the identities (C-9) into equation (C-9c), it is found that 

sin y = sin 0 cos a - cos 0 sin a cos <)> (C-9d) 
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The kinematic equation (C-9d) is exact, and holds for coordinated flight without restriction to first- 
quadrant angles. 

For wings-level flight (0 = 0), equation (C-9d) reduces to 


sin y = sin 0 cos a - cos 0 sin a = sin (0 - a) 
or 

y = 0 - a (C-9e) 

in agreement with the elementary definitions of these angles (app. B). 


Kinematic Approximations 

If the angles a, y, and 0 are small, then equation (C-9d) can be simplified to obtain the approximate 
relation 


0- y= a cos 0 


(C-90 


Equation (C-9f) is useful for the inverse control system described in the main report, where it 
enables the pitch command to be computed conveniently in closed form. It will be shown in the 
next two sections that the approximation (C-9f) remains valid even under the most extreme flight 
conditions encountered during controlled flight of transport aircraft. 

If the difference 0 - y is small, then it is clear from equation (C-9b) that, for roll angles in the first 
quadrant, 0' can be approximated by ()): 


0 = 0' (C-9g) 

• 

Substitution of the approximation (C-9g) into the lift equation (C-7c) eliminates dependence of the 
equations of motion for coordinated turning flight on the roll angle 0' taken about the velocity 
vector, which is not measured by conventional onboard instrumentation. 

Alternatively, if the pitch angle 0, the flightpath angle y, and the bank angle 0 are known from 
in-flight measurements or simulation computations, then the roll angle <|)' can be found from the 
exact equation (C-9b). Use of the exact roll angle in the lift equation (C-7c) could improve the 
accuracy of the lift command calculation for the inverse control system described in volume one of 
this report. It will be shown in the next two sections that use of the approximation (C-9g) is justified 
for coordinated flight over the range of bank angles extending from 0 to about 40 deg, which 
includes the range normally encountered in airline service. At larger bank angles, its use in the lift 
equation could result in significant lift error. 
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Limiting Flight Conditions for Transport Aircraft 

In order to test the validity of the approximations (C-9e) and (C-9g) with the largest practical values 
of a, y, 0, and 0, a minimum-radius climbing turn that is representative of a collision-avoidance 
maneuver is calculated as an example using the generic transport aircraft model developed in 
appendix B. It will be shown that this maneuver results in flight conditions that reach both structural 
and aerodynamic limits for transport aircraft. 

The aircraft load factor (denoted by n) is defined by the expression n = L/W. For a steady climbing 
turn, the flightpath rate dy/dt vanishes, and the load factor is found from equation (C-7c) to be 

n = L/W = cos y/cost))' (C-10) 

It is assumed that the design limit load factor nvux is 2.5 g, as is usual for transport aircraft (Shevell, 
1989). 

For a level turn (y= 0), equation (C-10) shows that the maximum roll angle is then given by 
cos <|)' = IMmax = 1/2.5, or <()' = 66.4 deg. Since the turn radius R is equal to the quotient V/di|/-r/dt, it 
is given by (eq. (C-7b)) 

R = V 2 /g tan 4>' 


Since n" = 1/cos 2 ty' = 1 + tan" ()/, so that tan" 4>' = n" - 1 , eliminating the roll angle (j)' results in the 
expression 


R = V 2 / g> /(n 2 -l) 

It is clear that the turn radius R is minimized by choosing the maximum load factor and the mini- 
mum airspeed, which corresponds to the maximum lift coefficient (app. B), and results in flight near 
the stalling angle of attack. It is assumed that the corresponding fuselage angle of attack is 15 deg. 

For a steady climbing turn, since the velocity component in the horizontal plane is V cos y 
(fig. C-3(b)), the aircraft follows a helical path whose radius is given by 

R hklix = ( V cos y)2 /g V(° 2 - 0 

The radius of the helix is minimized by climbing as steeply as possible (maximum y), which requires 
maximum thrust. It is assumed that the aircraft is at light weight, and the thrust loading near sea 
level is taken as a maximum value of T/W = 0.5. 
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For a steady climbing turn, the flightpath acceleration dV/dt vanishes, and the streamwise force 
equation (C-7d) becomes 

sin y = TAV - DAY = TAV (D/L) (LAV) = TAV - n/(L/D) (C- 10a) 

At the maximum lift coefficient of 1 .3 (app. B), the lift/drag ratio for the generic transport model 
using parameter values from table B-l (app. B) is found to be 12.36. With T/W = 0.5 and 
iimax = 2.5, the climb flightpath angle is found from equation (C-lOa) to be Ymax = 17.33 deg, and 
the maximum roll angle is found from equation (C-10) to be <])' = 67.55 deg. 

If the pitch angle 0 were known, the corresponding bank angle <|) could be found from equation 
(C-9b). Conversely, if the bank angle were known, the pitch angle could be found numerically 
from equation (C-9d). By using an iterative procedure involving both these equations, the solution 
0 = 22.46 deg, (j) = 72.69 deg is found numerically for y = 17.33 deg and a = 15 deg, which can be 
verified by direct substitution in equations (C-9b) and (C-9d). These exact values can now be 
compared with those obtained from the approximate equations (C-9f) and (C-9g). 

Approximation Validity 

For (f) 7 = 67.55 deg, the approximate value of <|) obtained from equation (C-9g) is also 67.55 deg. 

The exact value of 0 is 72.69 deg, so that the roll error is 67.55 - 72.69 = -5.14 deg. For the values 
y= 17.33 deg, a = 15 deg, and 4> = 67.55 deg, the approximate value of 0 obtained from equation 
(C-9f) is 23.05 deg. The exact value of 0 is 22.46 deg, so that the 0 error is +0.59 deg. If the 
approximate value for (j) of 67.55 deg is replaced by the exact value of 72.69 deg, the value of 0 
obtained from equation (C-9f) is then 21.79 deg, so that the 0 error becomes -0.67 deg. 

These 0 errors seem rather insignificant, especially after considering the extreme severity of the 
assumed Bight conditions, and they would be even smaller for operating conditions normally 
encountered in airline service. Therefore, the kinematic approximation (C-9f) can be considered 
valid over the whole range of conditions encountered by transport aircraft during coordinated flight. 
On the other hand, the error in the lift equation (C-7c) resulting from use of the kinematic approxi- 
mation (C-9g) for roll angle is more significant. 

For the minimum-radius climbing turn, if the exact value for the roll angle <J>' of 67.55 deg is 
replaced by the exact value for the bank angle <{) of 72.69 deg, the load factor obtained from equation 
(C-10) is 3.21 g. Since the exact value of the load factor is 2.50 g, the normal acceleration error is 
0.71 g, an overestimate which amounts to 28% of the lift. 

However, if the load factor is limited to 1.1 g (perhaps by proximity to stall), which corresponds to a 
less extreme bank angle of 39.3 deg in the climbing turn, the normal acceleration error is reduced to 
0.078 g. an overestimate of 7. 1 % of the lift. Furthermore, the lift error decreases rapidly with further 
decrease of bank angle. Therefore, the approximation (C-9g) can be considered valid for bank angles 
smaller than about 40 deg; that is, for the range of bank angles normally encountered in airline 
service. 
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APPENDIX D 

ELEMENTS OF PROPOSITIONAL LOGIC 


This appendix presents a concise review of elementary propositional logic that is needed to support 
developments in Volume 1 of this report. Formal logic is a classical discipline; Greek propositional 
logic was recast by Boole (Boole, 1854) into algebraic form. The two forms are logically equivalent. 
Both forms are treated in this appendix, because they illuminate the subject material from different 
perspectives. However, the logical form is used in the main report. 

After a brief review of logical operations and truth tables, several elementary theorems are proved 
by the method of perfect induction, and a list of theorems is provided for reference. Logical simplifi- 
cation of composite propositions is illustrated by deriving several results needed for the main report, 
and the appendix concludes with a discussion of condition-action decision tables, which must be 
characterized by logical consistency and completeness. 


Elementary logical propositions are simple declarative statements like “The grass is green" or “It is 
raining.” Logically, it is taken as axiomatic that such elementary statements must be either true or 
false. In the logical form termed symbolic logic , elementary propositions are represented by letter 
symbols like p and q; in the algebraic form, they are represented by algebraic variables (termed 
Boolean variables) like X and Y, which are restricted to take on only the binary values zero or one. 
In Boolean algebra, the symbol 0 represents FALSE, and the symbol 1 represents TRUE. 


Elementary propositions can be combined to form compound statements like “It is raining, and the 
grass is green.” Such a compound proposition is itself a single logical entity that must be either true 
or false, which is termed its truth value. The truth value of a compound statement depends on the 
truth or falsity (abbreviated as T and F) of the elementary propositions from which it is formed; it 
can be determined by construction of a truth table as follows: 


ELEMENTARY LOGICAL PROPOSITIONS 


Truth Tables 


TRUTH TABLE FOR CONJUNCTION 


P 




p AND q 


F 

F 

T 

T 


F 

T 

F 

T 


F 

F 

F 

T 
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The first row of this truth table shows that if both p and q are false, then the compound statement p 
AND q (which is termed their conjunction) is false. The second and third rows show that if p is false 
and q true, or if p is true and q is false, then in both cases p AND q is false. The fourth row shows 
that if both p and q are true, then p AND q is true. 

In algebraic form, the same truth table has quite a different appearance. Denoting the operation of 
logical conjunction by the symbol x, the truth table becomes 

TRUTH TABLE FOR CONJUNCTION 


p q P x q 

0 0 o” 

0 1 0 

1 0 0 

1 1 1 


It is obvious from inspection of this table that, from an algebraic viewpoint, the operation of logical 
conjunction can be regarded as logical multiplication acting on the Boolean variables 0 and 1 , with 
its multiplication table defined as follows: 

TRUTH TABLE FOR CONJUNCTION 

0x0 = 0 
0x1=0 
1x0 = 0 
1x1 = 1 

Proceeding in the same way, the truth value of the compound statement p OR g, which is termed the 
logical disjunction of p and q, can be regarded as logical addition (denoted by the symbol +), with 
truth tables defined as follows: 


TRUTH TABLES FOR DISJUNCTION 


P 0 p OR q 

F F F ' 

F T T 

TFT 
T T T 


0 + 0 = 0 
0+1 = 1 
1+0 = 0 
1 + 1 = 1 


It can be seen from the fourth row of the addition table on the right that logical addition does not 
follow the same rule as ordinary algebraic addition. Nevertheless, Boolean algebra forms a mathe- 
matically consistent system. 
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Logical Operations 


At this point of the discussion, the notions just presented can be generalized to include the other 
commonly used ways of combining elementary propositions to form compound propositions, which 
are negation , implication , and equivalence ; in Boolean algebra, negation is termed complementation , 
equivalence becomes equality, and implication is not defined. The complete set of operations is 
therefore conjunction, disjunction, negation, implication, and equivalence; with the exception of 
negation, these are termed logical connectives , since they connect elementary propositions to form 
compound propositions. 

Each of these operations is defined by a truth table similar to those already presented for conjunction 
and disjunction. The truth tables for negation (denoted by the symbol — i), implication (denoted by 
the symbol =». and equivalence (denoted by the symbol =) are as follows: 

TRUTH TABLES FOR NEGATION 

P -«P 

_ F " f -.0 = 1 

T F —.1=0 

TRUTH TABLE FOR IMPLICATION 

p q p=>q 

F F t" 

F T T 

T F F 

T T T 

It should be noted that the first and second rows of the truth table for implication express the rule 
that "anything follows from a false antecedent,” the third and fourth rows agree with the notion of 
implication in the everyday use of natural language, and also with the mathematical statement 
“if p, then q.” 


TRUTH TABLE FOR EQUIVALENCE 


p q p = q 

F F t" 

F T F 
T F F 
T T T 


Equivalence can be regarded as reversible implication: if p implies q and q implies p, then p and q 
are equivalent. 
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Elementary Logical Theorems 


Consider the compound logical proposition p OR TRUE. Since it has the same form as the proposition 
p OR q where q is equivalent to TRUE, its truth value can be found by forming the truth table for p OR 
TRUE, and evaluating the result by referring to the truth table for disjunction: 


TRUTH TABLES FOR p OR TRUE 


p 

T 

p OR T 


F 

T 

T 

0+1 = 1 

F 

T 

T 

0+1 = 1 

T 

T 

T 

1 + 1 = 1 

T 

T 

T 

1 + 1 = 1 

The coincidence of the second and third columns shows that p OR TRUE is equivalent to TRUE. (The 

second and fourth rows are redundant, and 

can be dropped.) In symbols, 


p OR T = T p + 1 = 1 (A) 

Statement (A) is a theorem in symbolic logic, which we have proved by the method of perfect 
induction (that is, by comparison of truth table columns — two propositions are logically equivalent if 
and only if their truth table columns coincide). 

By proceeding in a similar manner, we can prove that p AND TRUE is equivalent to p. The truth table 
is as follows: 


TRUTH TABLES FOR p AND TRUE 

p T p AND T 

¥ T F 0x1=0 

T T T 1x1=1 

The third column is obtained by referring to the truth table for conjunction. The coincidence of the 
first and third columns proves the second theorem: 

p AND T = p p x 1 = p (B) 

Statement (B) is also a theorem in symbolic logic. 

As a third example, the truth table for the proposition p OR -.p is as follows: 
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p 

F 

T 


TRUTH TABLES FOR p OR 


— ip p OR — ip 

T T 0+1=1 

F T 1+0=1 

The second column is obtained from the first by referring to the truth table for negation, and the 
third column is obtained from the first two by referring to the truth table for disjunction. The third 
column shows that the proposition p OR — ip always holds, without regard to the truth value of p. In 
symbols. 


p OR -,p = I p H — ip = 1 (C) 

Statement (C) is another theorem in symbolic logic. (Theorem (C) is the well-known law of the 
excluded middle', all these theorems were known to the Greeks.) 

The proposition p OR -.p is one example of a tautology, which is defined as a compound proposition 
that holds because of its form, independent of the truth values of its component elementary proposi- 
tions. The proposition p OR TRUE is another example, as shown by Theorem (A). 

Other theorems involving more complicated combinations of elementary propositions can also be 
proved by the method of perfect induction, which is demonstrated next. 


COMPOSITE LOGICAL PROPOSITIONS 

Since each compound expression is itself a logical proposition, as already noted, it follows that 
compound propositions can be combined by means of logical connectives to form more complicated 
propositions; indeed, an elementary proposition is sometimes defined as one that does not contain 
any connectives. To avoid ambiguity, composite propositions formed by combining three or more 
elementary propositions must include parentheses to indicate the sequence in which evaluation is to 
be carried out, just as in ordinary algebra. The commutative, associative, and distributive laws hold 
axiomatically, just as in ordinary algebra. 

For example, consider the composite proposition p OR (p AND q). The parentheses show that the 
conjunction p AND q is to be evaluated first, by means of the truth table for conjunction. Let the 
result be denoted by r, so that the equivalence r = (p AND q) holds. The disjunction p OR r is then to 
be evaluated by means of the truth table for disjunction. 

The truth table for the composite proposition p OR (p AND q) is constructed as follows. The first 
three columns of the combined table are the same as those for the truth table for conjunction, with r 
replacing p AND q: 
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TRUTH TABLE FOR p OR (p AND q) 


P 

F 

F 

T 

T 


q 

F 

T 

F 

T 


r 

F 

F 

F 

T 


P 

F 

F 

T 

T 


p OR r 

F 

F 

T 

T 


To form the disjunction p OR r, the fourth column is added to the table by repeating the first column, 
and the last column is obtained by evaluating each row of the third and fourth columns according to 
the truth table for disjunction. It will be seen that the last column coincides with the first; therefore, 
the truth table proves that the composite proposition p OR (p AND q) is equivalent to p. In symbols, 

p OR (p AND q) = p p + (p x q) = p (D) 

Statement (D) is another theorem in symbolic logic. 

Theorem (D) can be verified algebraically as follows. Apply the distributive law to factor out p on 
the left-hand side: 


px(l +q) = p 

Now simplify the parenthesis by applying Theorem (A) to obtain 

p x ( 1 ) = p, 

and simplify the left-hand side by applying Theorem (B) to obtain 

p = p. 


which verifies Theorem (D). 


ELEMENTARY THEOREMS IN SYMBOLIC LOGIC 

As this example (Theorem (D)) shows, proof of a new theorem is often facilitated by using other 
theorems already established, instead of proceeding from first principles by the method of perfect 
induction. Nevertheless, truth tables are regarded as the “gold standard” for logical proof. By com- 
bining the two proof methods, other elementary theorems can be established (Dromey, 1989; Bartee, 
1985). A reference list of 23 such theorems, which follows the format of Dromey, can be found in 
the List of Theorems. 
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LOGICAL SIMPLIFICATION OF COMPOSITE PROPOSITIONS 


The process of simplifying composite logical propositions by application of elementary theorems is 
illustrated by deriving several results needed for the main report. 

Simplification of Definition for PE (V) 

The partial effectiveness of the V Command mode is defined as follows (Volume I (Effectiveness 
Requirements)): 

PE (V) = NOT |P AND (Ypottgt * Ypotmax)J AND NOT [Q AND (Ypottgt * Ypotmin)] 
Expressing negation symbolically, this of the form 

PE (V) = — 1| P AND MJ AND — •[ Q AND NJ 
where M and N are given by the equivalences 

M = (Ypot tgt * Ypot max) N = (Ypot tgt ^ Ypot min)J 

Simplification of PE (V) is needed for the following three cases: 

(a) (Ypottgt = Ypot max) holds; 

(b) (Ypottgt = Ypot min) holds; and 

(c) (Ypotmin < Ypottgt < Ypot max) holds. 

In case (a), M is false and N is true, so that PE (V) becomes 

PE (V) =-<[P AND F| AND-.IQ AND T] 

By applying Theorem 13, the first bracketed proposition reduces to F, and the second reduces to Q. 
Removing the brackets by taking negations results in PE (V) = T AND — >Q, which simplifies to — .Q 
by a second application of Theorem 13. Expressing case (a) in the form of an implication gives 

(a) (Ypottgt = Ypot max) => (PE (V) = — iQ) 

In case (b). M is true and N is false, so that PE (V) becomes 

PE (V) = — ,[P AND TJ AND — |[Q AND FJ 

By applying Theorem 1 3, the first bracketed proposition reduces to P, and the second reduces to F. 
Removing the brackets by taking negations results in PE (V) = — iP AND T, which simplifies to — iP by 
a second application of Theorem 13. Expressing case (b) in the form of an implication gives 

(b) (Ypottgt = Ypot min) => (PE (V) = — P) 
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In case (c), both M and N are true, so that PE (V) becomes 


PE (V) = —.[P AND T] AND — |[Q AND TJ 

By applying Theorem 13, the first bracketed proposition reduces to P, and the second reduces to Q. 
Removing the brackets by taking negations results in PE (V) = — iP AND — .Q. Expressing case (c) in 
the form of an implication gives 

(c) (Ypot min < Ypottgt < Ypot max) => IPE (V) = ( — .P AND — >Q)J 
Collecting results, the required simplification of PE (V) is 
(a) (Ypot tgt = Ypot max) => ( PE ( V) = — iQ) 

(t>) (Ypottgt = Ypot min) => (PE (V) = — iP) 

(c) (Ypot min < Ypottgt < Ypot max) => IPE (V) = (— iP AND — >Q)J 

This completes the first example. 

Simplification of Definition for PE (y) 

The partial effectiveness of the y Command mode is defined as follows (Volume I (Effectiveness 
Requirements)): 

PE (Y) = (Ytgt < Ypot max) OR KYtgt ^ Ypot max) AND (V > V MI n drag)J 
This is of the form 

PE (y) = M OR l— iM AND NJ 
where M and N are given by the equivalences 

M = (Ytgt < Ypot max) N = ( V > V min drag) 

By applying the distributive law given by the first statement of Theorem 9. PE (y) becomes 

PE (y) = (M OR — iM) AND (M OR N) 

Because the first bracketed expression is tautologically true (Theorem 4), PE (y) becomes 

PE (y) = T AND (M OR N) 

Applying Theorem 13 reduces this to PE (y) = (MOR N), and replacing M and N with their equiva- 
lent expressions gives the final result: 

PE (y) = (Ytgt < Ypot max) OR (V > V min drag)- 
This result could also have been obtained directly by application of Theorem (D). 
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CONDITION-ACTION DECISION TABLES 


Another logical tool needed for the main report is used to specify actions to be taken by an auto- 
mated system if and only if certain logical conditions hold. Such actions can be specified in compact 
form by tables that are termed condition-action decision tables. This section describes the arrange- 
ment and interpretation of such tables, including conventions for the solid or broken lines that sepa- 
rate the elements of the table and form an essential part of the specification (Sherry, Youssefi, and 
Hynes, 1995). There are two kinds of decision tables, a simple table that specifies condition-action 
pairs, and a more complex table that also specifies mode selection. The simple table is treated first. 

Simple Condition-Action Tables 

A simple condition-action decision table has the following form: 


TABLE D-1 


Condition 

P 

q 

r 

Action 

1 

2 

3 


It can be seen that the upper row of table D-l specifies logical conditions p, q, and r, and the lower 
row specifies actions 1, 2, and 3. Each column of the table specifies a condition-action pair; the first 
column specifies the pair (p, 1 ), the second column specifies the pair (q, 2), and the third column 
specifies the pair (r, 3). Other columns could be added as desired. 

Table D-l is interpreted as follows. If condition p holds, then the first column shows that action 1 is 
to be taken; the other columns are interpreted in the same way. Condition p could represent any logi- 
cal proposition, either simple or compound, and action I could represent any action or set of actions 
that are to be specified. 

To avoid ambiguity, it is essential that the conditions be mutually exclusive, so that whatever the 
truth values of the conditions p. q. and r may be. in any particular situation one and only one action 
is specified. This property is termed logical consistency. If logical consistency does not hold, the 
table is said to be logically inconsistent. For example, if p and q could both hold, logical consistency 
would be violated; in that case, more than one action would be specified, so that the specification 
would fail to be unique. 

A second essential property of table D-l is that disjunction of the conditions (that is, the compound 
proposition (pORqOR r)) must be tautologically true, whatever the truth values of p, q, and r. This 
property is termed logical completeness. If logical completeness does not hold, the table is said to be 
logically incomplete; in that case, other logical conditions or combinations of conditions could exist 
for which no action is specified. 
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Mode Selection Tables 


For the automated system described in Volume I of this report, a mode is defined as a characteristic 
set of actions that the system can take; that is, a physical behavior (Volume I (Flight Control Sys- 
tem)). Therefore, decision tables involving mode selection must specify the three-way relationship 
between the logical conditions that govern mode selection, the modes available for selection, and the 
set of actions associated with each mode. Such tables have the form illustrated by the following 
example: 


TABLE D-2 


Mode 

Mode A 

Mode B 

Mode C 

Scenario 



Normal 

Abnormal 

Condition 

m 

T 




-im 


T 

T 


n 


T 



—in 

T 




p 

T 



T 

A 

T 

T 



r 



T 


Action 

Action 1 

Action 2 

Action 3 


It can be seen that the upper row of table D-2 specifies three modes A, B, and C. The second row 
specifies an entity termed a scenario, which is explained later and should be ignored for the present. 
The legend Condition in the left column identifies seven logical conditions m, — im, n, —in, p, q, and 
r, which are arranged in the next seven rows below the Condition legend. The significance of the 
broken horizontal lines in table D-2 will be explained shortly; for the present, all the horizontal lines 
should be regarded as solid. The lowest row of table D-2 specifies three actions 1, 2, and 3. Other 
columns could be added to the table as desired. 

In each column, the entries in the body of table D-2 show the logical conditions that must hold for 
selection of the mode corresponding to that column, and also the action that is to be taken when that 
mode is selected. For example, in the first column the conditions required to hold for selection of 
mode A are indicated by the various entries of the symbol T, which denotes TRUE; it can be seen that 
conditions m, —in, p, and q are required to hold for selection of mode A. If mode A is selected, the 
lowest row of the left column shows that action 1 is to be taken. The entries in the other columns are 
interpreted in the same way. Blank spaces in each column of the table indicate conditions whose 
truth values are not relevant for mode selection in that column. 

The two columns on the right both correspond to mode C, which is to be selected if the conditions in 
the third column (the normal scenario) hold, or alternatively, if the conditions in the fourth column 
(the abnormal scenario) hold. In both cases, action 3 is to be taken; each action is uniquely associ- 
ated with its corresponding mode, without regard to the scenario (column) by which mode selection 
is determined. 
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Line codes- It can be seen that the rows of table D-2 are separated by horizontal lines of two kinds, 
either solid or broken. The interpretation of this line code is as follows. Broken horizontal lines indi- 
cate disjunction of the conditions in the rows they separate, while solid lines indicate conjunction. 
For example, in the column for mode A, it may be seen that the T entries in the rows for conditions p 
and q are separated by a broken horizontal line. This shows that the disjunction (p OR q) is required 
for selection of mode A. The solid lines separating the T entries in the m row, the —in row, and the 
p row show that the conjunction of m and —in with the compound condition (p OR q) is required for 
selection of mode A. That is, the compound condition that must hold for selection of mode A as 
specified by table D-2 can be stated in implication form as follows: 

[m AND —in AND (p OR q)] => (Selection of mode A) 

The compound conditions in the columns for mode B and mode C are specified by the line code in 
the same way. 

Logical consistency and completeness- For logical completeness, the logical disjunction of the 
conditions in rows separated by broken lines must hold tautologically. For example, because the 
rows for conditions p, q, and r are separated by broken lines (table D-2), their logical disjunction 
(p OR q OR r) must hold tautologically; otherwise, table D-2 would be logically incomplete. 

Logical completeness requires careful attention to the definition of logical conditions that depend on 
physical variables. For example, suppose that p represents the condition (X < U), q represents the 
condition (U < X < V), and r represents the condition (X > V), where X is a continuous physical 
variable and U and V are constants. The requirement for logical completeness is satisfied by these 
definitions, because physical continuity ensures that no value for X exists for which none of the 
three conditions p, q, or r holds. On the other hand, if p were defined as the condition (X < U) 
instead of (X < U), then logical completeness would be violated, because if X took the value 
(X = U), none of the three conditions would hold. In this example, a parsimonious use of symbols 
could be achieved by using the logical simplification q = — ip — ir to eliminate q. The conditions 
appearing in table D-2 would then be p. — ip — ii\ and r; their disjunction can be seen by inspection to 
hold tautologically. It is clear that the line code in table D-2 facilitates checking the table for logical 
completeness. 

Logical consistency is a more delicate matter. For logical consistency, the selection logic for each 
column must be mutually exclusive; that is. the pattern of T entries must be different in each col- 
umn. If any two columns had the same pattern, then either or both of the corresponding modes could 
be selected, depending on the exact details of the implementation code. Therefore mode selection 
would fail to be mutually exclusive (unique) as required. For large decision tables with many col- 
umns, checking logical consistency by inspection can become quite tedious, but the task can be 
automated by means of utility programs developed for that purpose. 

Hierarchical decision tables- For a large automated system like that described in the main report, it 
is often convenient to combine several decision tables into a hierarchical relationship. This can be 
achieved without changing the structure already described for table D-2 by specifying additional 
actions, such as “Enter Table E.” Table E could then contain an action “Enter Table F” and so on. 

The hierarchical structure can be built up recursively in this way to whatever extent is desired. 
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LIST OF THEOREMS (after Dromey) 


Symbols 



Conjunction x Disjunction 

+ Negation — i 


Equivalence = Implication 



Theorems 


(1) 

P = P 

Law of identity 

(2) 

P + P = P 
pxp = p 

Idempotent laws 

(3) 

-<->P) = P 

Law of double negation 

(4) 

p + —ip = T 

Law of the excluded middle 

(5) 

— >(p x — ip) = T 

Law of contradiction 
(also used as p x — ip = F) 

(6) 

(P => — .p) E ^P 

Reductio ad absurdum 

(7) 

p+q=q+p 

P x q = q x p 

(p = q) — (q = p) 

Commutative laws 

(8) 

(p + q) + r = p + (q + r) 
(pxq)xrspx(qxr) 

Associative laws 

(9) 

p + (q x r) = (p + q) x (p + r) 
p x (q + r) = (p x q) + (p x r) 

Distributive laws 

(10) 

(p => q) x (q => r) => (p => r) 
(p s q) x (q = r) => (p =r) 

Transitive laws 

(11) 

— <(p q) = — -p x — iq 

De Morgan’s laws 


— <(p x q) = ip H 
i(p => q) = p X -iq 

~ <(p = q) - ( P = ^q) 
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(12) 

p + T = T 

OR simplification 


P + P = P 

(note: p + F = p 


p + (p x q) s p 

T + T = T 
T + F s T) 

(13) 

pxT = p 

AND simplification 


pxp = p 

(note: p x F = F 


p x (p + q) m p 

TxFeF 
T x T = T) 

(14) 

(p => q) x (q => r) = (p => q x r) 
(p => r) x (q => r) = (p + q => r) 
(p => q) + (p => r) = (p => q + r) 
(p => r) + (q => r) = (p x q => r) 

Implication simiplificat 

(15) 

(p => q) = (— iq => -ip) 

(psq)shpsnq) 

Contraposition 

(16) 

p=>p + q 

(p => q) => (p => q + r) 
(p => q) => (p x r => q) 

Law of addition 


(p => q) => (p => (p x q)) 

Law of absorption 

(17) 

pxq^p 

Law of simplification 

(18) 

(p x q => r) => (p => (q => r)) 
(p + q => r) => (p r) 

Law of exportation 

(19) 

(p => (q r)) => (p x q => r) 
(p => (q x r)) => (p => q) 

Law of importation 

(20) 

(p => (q x -iq)) => -ip 

Law of absurdity 

(21) 

p x (p => q) => q 

Law of detachment 

(22) 

-.q x (p => q) => -.p 


(23) 

->p x (p + q) => q 
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APPENDIX E 

STATECHART SEMANTICS 


Statecharts provide a graphical representation of discrete logical systems, which are termed state 
machines. In this report, statecharts represent the discrete elements of hybrid systems such as flight 
control systems. The continuous elements of these hybrid systems are represented by block diagrams 
containing input/output transfer functions, such as those illustrated by figure 1 1 in Volume 1. This 
appendix summarizes statechart interpretation conventions (termed semantics), which enable state- 
chart diagrams to serve as rigorous specifications for the operation of discrete state machines. 

Such state machines could be implemented directly in hardware by means of relays, or in concurrent 
(parallel) digital computers. However, for reasons that will become clear in the discussion to follow, 
within the aircraft industry it is considered desirable to implement both the discrete and continuous 
elements of hybrid systems within a single clock-based sequential processor. Several changes to 
conventional statechart semantics are needed to facilitate implementation within a single sequential 
machine. These issues are discussed in detail, and suitable semantic modifications proposed, it is 
shown by a simplified example that these modifications enable implementation code for a sequential 
machine to be prepared directly from statechart diagrams. 

In particular, it is required by conventional statechart semantics that changes in the logical condi- 
tions governing mode transitions be propagated instantaneously throughout the system. This conven- 
tion, termed broadcast synchronization, can be violated in a sequential machine. Such violations are 
analyzed in detail, and their implications for formal validation are assessed: it is shown that, under 
certain conditions, unacceptable delay in the identification of safety-critical failures could result 
from an improperly chosen sequence of computation. 


CONVENTIONAL STATECHART SEMANTICS 
State Transition Diagrams 

A state transition diagram for a simple state machine is illustrated by figure E-l. In figure E-l, the 
three circles represent states designated A. B, and C, and the arrows represent transitions between 
states. For example, these states could be identified with the modes of a flight control system. Each 
transition is governed by a condition indicated on the diagram by legends labeling each transition 
arrow. For example, condition 1 must hold for the transition from state A to state B to occur, condi- 
tion 2 must hold for the transition from state B to state C to occur, condition 3 must hold for the tran- 
sition from state C to state A to occur, and condition 4 must hold for the transition from state A to 
state C to occur. The unlabeled arrow pointing to state A indicates that the system is to be initialized 
in state A before operation commences. The rectangles in the diagram represent actions that must be 
taken at the time a transition occurs; for example, action (a) must be executed whenever the system 
transitions from state A to state B. 
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Figure E-1. State transition diagram. 

For the deterministic state machines considered in this report, logical consistency requires that 
operation be specified uniquely, so that state transitions must be mutually exclusive. For example, 
in state A, condition 1 and condition 4 must not both hold at the same time; otherwise, machine 
operation is nondeterministic. Logical completeness requires that operation be specified for all pos- 
sible combinations of the conditions governing transitions; otherwise, a combination of conditions 
could be presented for which operation of the machine would be undefined. 

Null transitions can be represented explicitly if desired. For example, if the system is in state A and 
conditions I and 4 are both false, the system remains in state A, as indicated by the broken arrow. 

For logical completeness, the broken arrow must be labeled by the concatenation of the negations of 
each condition that would cause transition out of state A, as shown on the diagram. Explicit repre- 
sentation of null transitions enables verification of logical completeness. However, such arrows 
clutter the diagram, and the concatenation of all transitions out of state A can become logically com- 
plex in large systems. Alternatively, null transitions can be suppressed to simplify the diagram after 
logical completeness has been verified by some other means. 

It is clear that state transitions depend only on the current state and the current conditions, and not on 
the past history of the state evolution, so that the process is Markovian. It is assumed that changes in 
the logical conditions are propagated instantaneously throughout the system, a convention termed 
broadcast synchronization. 


Hierarchical Statecharts 

An elaboration of conventional state transition diagrams that provides a more natural representation 
of aircraft systems and possesses several other advantages (Harel, 1987) is illustrated by figure E-2. 
In figure E-2, two state machines have been combined to form a higher-level entity termed a super- 
mode in the diagram, with system hierarchy indicated by enclosing the two lower-level machines 
within an outer boundary. Thus figure E-2 is to be regarded as the projection of a three-dimensional 
structure onto the two-dimensional plane. In figure E-2. the states are represented by rectangles with 
rounded comers instead of circles as in figure E-1. Concurrent (parallel) operation of the two lower- 
level machines is indicated by the broken vertical line in the diagram, which shows 
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Figure E-2. Hierarchical statechart. 

that the supermode consists of the Cartesian product of the two lower-level systems. It should be 
noted that, in the diagram, condition 2 governs transitions in both lower-level machines. 

To express the operation of the system of figure E-2 as a conventional state transition diagram like 
Figure E-l, six states are required to form the Cartesian product, since the machine on the left of 
figure E-2 has three states, and the machine on the right has two. Thus representation of the com- 
bined system in the hierarchical form of figure E-2 has saved one state. This economy should not be 
regarded as trivial. If each of the lower-level machines contained 100 states, 10,000 states would be 
required to represent the system as a conventional “flat” state transition diagram, while representa- 
tion in the three-dimensional hierarchical form would require only 200 states. Corresponding 
economies are also realized in the effort required to analyze the operation of such complex systems, 
which increases rapidly with the number of states involved. 

Furthermore, if each of the lower-level machines represents an aircraft subsystem (such as a hydrau- 
lic system and an electrical system), the hierarchical representation enables designers to deal with 
them in a natural way, avoiding the need to form their Cartesian product. Finally, in preparing 
system documentation for use by groups representing different design disciplines, the hierarchical 
representation enables low-level detail to be suppressed to whatever extent is considered desirable, 
since the internal details of figure E-2 could be omitted without destroying the usefulness of the 
diagram at still higher levels. 

It should be noted that hierarchical decision tables can serve as an alternative method for specifying 
state machine operation that is logically equivalent to statecharts (Sherry, Youssefi, and Hynes, 
1995). The statecharts discussed in this report could be translated into such decision tables, for 
which automatic generation of implementation code is available (King et al., 1994). 
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Aircraft Implementation 


Several fundamental issues discussed later can be clarified by considering some simple physical 
models. In principle, the continuous elements of the hybrid control system could be implemented in 
analog hardware, and their discrete elements implemented by relays controlled directly by analog 
signals, as they were in aircraft autopilots designed before the mid-1970s. Alternatively, the state 
machine illustrated by figure E-l could be implemented within a parallel computer, with three pro- 
cessors synchronized by the exchange of interrupts. 

In current aircraft, the continuous elements are implemented by digital computation using short 
clock-based time steps. A real-time operating system representative of current aircraft is illustrated 
in statechart form by figure E-3. It can be seen that when power is applied, the system first initializes 
computer memory and then enters the operating mode. In the operating mode, the processor contin- 
uously executes various background tasks not requiring precise timing, until it is interrupted by the 
clock. The clock interrupt transfers execution to foreground tasks, such as flight control, that require 
precise timing. 

In figure E-4, a state machine for flight control mode selection is shown embedded in this flight 
computer system as one of many foreground tasks, together with other tasks that implement the 
continuous system elements that are controlled by mode selection. Since there is only a single 
processor, the various foreground tasks must be executed sequentially instead of concurrently. In 
figure E-4, the broken vertical lines now represent sequential operation, with time increasing to the 
right, in contrast to the concurrent operation represented by the broken vertical line in figure E-2. 

All foreground tasks must be completed before the next clock interrupt starts foreground execution 
again. Whatever time remains after foreground execution is complete is applied to the background 
task, which resumes at the point at which it was previously interrupted. 



Figure E-3. Real-time operating system. 
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Figure E-4. Flight control mode selection example. 

Because sequential computation can only approximate concurrent processing instead of implement- 
ing it exactly, it is clear that implementation in a sequential, clock-based machine instead of a 
concurrent, interrupt-driven machine may require some modifications to conventional statechart 
semantics. These modifications are discussed in detail in the next section. The discussion begins by 
considering emulation of the continuous system elements. 


MODIFICATIONS FOR SEQUENTIAL PROCESSING 

Emulation of Continuous System Elements 

Continuous functions of time are approximated in digital computation by discrete staircase functions 
that coincide with the continuous function only at the instant of update (fig. E-5). The duration of 
these time steps must be short relative to the time scale of the continuous process being approxima- 
ted, in order to achieve sufficient computational accuracy and avoid numerical instability. In current 
aircraft, the duration of each time step, which is termed the computation frame, ranges from 10 mil- 
liseconds in high-performance aircraft to 50 milliseconds in older transports. 

In the emulation of a continuous dynamical process, the computations should be carried out in a 
well-defined sequence that is determined by functional dependency. For example, state estimates 
such as altitude should be updated before they are used as inputs to the control laws. Otherwise, 
excess delay is introduced by out-of-sequence computations that degrades both dynamic accuracy 
and closed-loop stability. Because the requirement that the calculations be carried out in correct 
sequence severely restricts the possibilities for parallel computation, the discrete emulation of a 
continuous dynamical process can be regarded as inherently clock-based and sequential. 
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Figure E-5. Discrete emulation of continuous function. 


Emulation of Discrete System Elements 

The question can now be raised: how should the emulation of the concurrent, interrupt-driven sys- 
tem represented by conventional statecharts be related to the sequential, clock-based emulation of 
the underlying continuous process that is being controlled by mode selection? Since mode transi- 
tions are initiated by changes in the conditions, which are evaluated continuously in conventional 
statechart semantics, it is logical to ask first how these conditions should be discretized. 

Within each computation frame, the natural time reference is the instant at the beginning of the 
frame, which is the time at which the emulation of the continuous system is most accurate. It follows 
that the conditions should be updated to the beginning of each frame before they are used in the 
emulation of the state machine to determine mode transitions. This policy emulates the broadcast 
synchronization convention at the instant of update. 

Definition of Time Step 

In the concurrent system illustrated by figure E-6(a), suppose that the system is in state A, and that 
condition 1 is FALSE and condition 2 is TRUE. The system remains in state A. If now some external 
stimulus makes condition I TRUE, the system transitions first to state B and then to state C 
(fig. E-6(a)). Generalizing, it is clear that, in a complex system, a single external stimulus can 
produce a Hurry of transitions before a new steady state is reached. Observation of such equilibrium 
states has been proposed as the basis for definition of a time step in concurrent systems (Harel, 1987; 
Leveson et al., 1992). 

It is difficult to emulate this process within a sequential processor in real time. To illustrate the 
difficulty, consider a naive attempt to emulate the state machine of figure E-6(a) by embedding the 
following pseudocode within the foreground tasks of figure E-4. 



a) b) 


Figure E-6. Modification of state machine for sequential implementation. 

IF (State A) THEN 

IF (Condition 1 ) THEN 

Transition to State B 

ELSE 

Remain in State A 
END IF 

ELSE IF (State B) THEN 

IF (Condition 2) THEN 

Transition to State C 

ELSE 

Remain in State B 
END IF 

ELSE IF (State C) THEN 

IF (Condition 3) THEN 

Transition to State A 

ELSE 

Remain in State C 
END IF 

END IF 

According to the IF... ELSE IF syntax, whenever a TRUE condition is found the processor executes a 
single mode transition and then skips to the following END IF. Furthermore, the entire routine is 
executed only once during each frame (figs. E-3 and E-4). Therefore, it is clear that this pseudocode 
allows only one mode transition per time step. If the system is initially in state A and condition I and 
condition 2 both hold, the machine specified by this pseudocode transitions to state B and remains 
there during the first time step (frame). At the next time step, the system transitions to state C. Thus 
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the semantics of the pseudocode differ from those of the conventional statechart (fig. E-6(a)), for 
which the transition from state A to state C would be instantaneous. 

This difference is not trivial. For example, suppose that the falsity of condition 2 is required for 
validity of the mode corresponding to state B. and that the truth of condition 2 represents a sensor 
failure that requires the system to transition to state C. If the underlying continuous system emulated 
in state B involves state estimation by recursive filtering, a single frame of computation in the mode 
corresponding to state B with an invalid input could fatally corrupt the recursive estimates. 

Possibly the pseudocode implementation could be modified so as to match the statechart semantics 
by executing the pseudocode repeatedly until a steady state is observed. However, such iteration is 
undesirable in real-time code because it contributes an unknown variation in execution time. Fur- 
thermore, if external stimuli continue to be presented, causing changes in the conditions governing 
transition, the system may never reach a well-defined, observable equilibrium state. 

Alternatively, the statechart semantics can be modified to incorporate a convention that allows only 
a single mode transition per frame. This definition of time step for the state machine seems to be 
the natural one for a clock-based sequential system. The function of the original statechart can be 
restored by adding a transition path directly from state A to state C that is traversed if both condi- 
tion 1 and condition 2 hold (fig. E-6(b)). The pseudocode for the modified system is then as follows. 

IF (State A) THEN 

IF (Condition I) THEN 

Transition to State B 

ELSE IF (Condition 1 and Condition 2) THEN ! Modification 

Transition to State C 

ELSE 

Remain in State A 
END IF 

ELSE IF (State B) THEN 

IF (Condition 2) THEN 

Transition to State C 

ELSE 

Remain in State B 
END IF 

ELSE IF (State C) THEN 

IF (Condition 3) THEN 

Transition to State A 

ELSE 

Remain in State C 
END IF 

END IF 
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This modification method can be generalized. Provided that the desired function of the state machine 
can be specified by adding appropriate transition paths to the conventional statechart while retaining 
the modified semantic convention that allows only a single mode transition per frame, then imple- 
mentation of the modified state machine within a sequential processor is straightforward. If null 
transitions are represented explicitly on the diagram, the modified statechart has the appealing inter- 
pretation that, at the beginning of each frame (“tick of the clock”), the system is required to execute 
one and only one of the state transitions indicated explicitly on the statechart by the transition 
arrows. 


Violation of Broadcast Synchronization Convention 

In emulation of statecharts within a sequential processor, another problem can be encountered that 
involves violation of the broadcast synchronization convention. As mentioned previously, this 
convention requires that all changes to the conditions governing transition be propagated instan- 
taneously throughout the system. For emulation, the logical conditions that govern transition should 
be updated to the beginning of the frame, as discussed previously. This updating process is straight- 
forward for transition conditions that depend only on quantities external to the flight control system, 
such as sensor measurements and their associated Boolean valids (that is, auxiliary quantities that 
report the results of external sensor validity tests). 

However, some transition conditions may depend on internally computed quantities like commanded 
flightpath angle and airspeed. These computed quantities are, in general, mode-dependent, and there- 
fore cannot be updated until after the Bight control modes have been selected for the current frame. 
Before update, these quantities are referred to the beginning of the previous frame, and so also are 
the transition conditions dependent upon them. It follows that propagation of these transition condi- 
tions is effectively delayed by one frame at the time of mode selection, violating the broadcast 
synchronization convention. 


Implications for Formal Validation 

In assessing the consequences of such violations, it seems useful to distinguish between cases for 
which not a single frame of delay in mode transition can be permitted, which is termed hard viola- 
tion. and those in which one or more frames of delay can be tolerated, which is termed soft violation. 
For example, consider a sensor failure that requires an immediate mode reversion without a single 
frame of delay. If detection of this failure depended on testing computed, mode-dependent quanti- 
ties, the mode reversion would occur one frame too late to avoid the execution of servo commands 
to the aircraft control surfaces that were dependent on the failed sensor, constituting a hard violation. 
Such a design should be considered unacceptable for Bight safety. 

Formal validation of systems subject to such failures lies outside the scope of this report. However, 
the dynamical process of mode evolution tends to proceed at a slower pace than the evolution of the 
underlying continuous states — typically, each mode transition is separated from the preceding one 
by several hundred frames. Therefore, most violations of the broadcast synchronization convention 
encountered in flight control systems are found to be soft. It is clear that formal validation of the 
Bight control system by the methods developed in this report requires verification of the softness of 
each such violation. 
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A DETAILED IMPLEMENTATION EXAMPLE 


With the modifications to conventional statechart semantics just developed, the statechart diagram 
forms a complete specification from which implementation code can be prepared. To illustrate this 
process, a simplified example is presented in this section, and the resulting pseudocode is compared 
with pseudocode generated by the well-established Jackson program design method (Jackson, 1975) 
It is shown that the two specification methods are equivalent for the example to be discussed. 

Statechart Example 

To illustrate the implementation procedure, it is assumed that the discrete mode control system 
illustrated by figures E-4 and E-6(b) is to be embedded in the clock-based sequential machine 
illustrated by figure E-3. The mode control task is to be accomplished by a subroutine (procedure) 
called from foreground, which selects the mode for the current frame and makes it available for use 
by the emulation of continuous system elements that follows mode selection (fig. E-4). 

It can be seen that the system is to be initialized in MODE A when power is first applied (fig. E-4). 
Thereafter, transitions between the three states MODE A. MODE B, and MODEC are governed by 
conditions 1, 2, and 3. According to the modified semantic convention developed in the previous 
section, only one mode transition is allowed at each time step, and the statechart of figure E-4 has 
been modified accordingly, as previously discussed. It is assumed that conditions 1 , 2, and 3 have 
been updated to the beginning of the frame by one of the other foreground tasks (fig. E-4) executed 
before mode control processing begins. 

Since the system is to be initialized in MODE A on the first frame of operation, but not subsequently 
(fig. E-4), it is logical to set a flag (to be called the lnit_DONE flag) to indicate that initialization 
should be skipped during all subsequent frames. It is assumed that the Init_DONE flag is initialized 
FALSE by the operating system when power to the flight computer is first applied (fig. E-3). 

After initialization, the mode selection depends on conditions 1, 2, and 3 as well as upon the mode 
selected during the previous frame. A nested IF structure could test conditions first, or previous 
mode first, or alternatively a case structure could avoid nesting entirely by combining condition and 
previous mode into a single compound condition. The choice among these alternatives must be 
based on psychological criteria relating to ease of use by humans, since considerations of computa- 
tional efficiency are trivial in this simple example. 

For this example it has been decided to test first for previous mode, based on our opinion that this 
choice leads to pseudocode that is easier to understand than that resulting from either of the other 
choices. Making use of standard structural forms for sequence and for choice among mutually 
exclusive alternatives, the pseudocode is then as follows (table E-l). (The numbers in parentheses 
following each action to be performed relate to the Jackson program design example to be discussed 
next, and should be ignored for the present.) 
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TABLE E-1 


Operating System Initialization 


Set Init_DONE flag FALSE ( 1 ) 


Subroutine Flight Control Mode Selection 


Called from Foreground 


IF (not Init_DONE) THEN 


First frame 


Select MODE A (3) 

Set Init_DONE flag TRUE (2) 


ELSE 


All subsequent frames 


IF (MODE A) THEN 


Process MODE A 


IF (not Condition 1 ) THEN 
Select MODE A (3) 

ELSE IF (Condition 1 and not Condition 2) THEN 
Perform Action (a) (6) 

Select MODE B (4) 

ELSE IF (Condition I and Condition 2) THEN 
Perform Action (b) (7) 

Select MODEC (5) 

END IF 

ELSE IF (MODE B) THEN ! Process MODE B 

IF (not Condition 2) THEN 
Select MODE B (4) 

ELSE IF (Condition 2) THEN 

Perform Action (b) (7) 

Select MODEC (5) 

END IF 

ELSE IF (MODE C) THEN ! Process MODE C 

IF (not Condition 3) THEN 
Select MODEC (5) 

ELSE IF (Condition 3) THEN 
Select MODE A (3) 

END IF 


END IF 


END IF 


RETURN (8) 


Jackson Program Design Example 


The Jackson program design method (Jackson, 1975) begins with the preparation of a diagram 
representing the structure of the input and output data streams hierarchically (fig. E-7). In figure E-7, 
the vertical dimension indicates hierarchy, and the horizontal dimension indicates time sequence, 
with time increasing from left to right. An asterisk placed at the upper right within a block indicates 
iteration, while a small circle indicates one among several mutually exclusive alternatives. 

Correspondences are then established between input and output data elements that occur in the same 
sequence (broken lines in figure E-7), and the corresponding data elements are combined to create a 
processing structure (fig. E-8). Specific operations (see Notes, figure E-8) necessary to achieve the 
required output are enumerated, and then added to the processing structure in the appropriate loca- 
tions determined by the required sequence of operations (fig. E-8). Finally, pseudocode is prepared 
directly from the program structure chart (fig. E-8). The Jackson method results in a unique program 
structure that guarantees correct sequential operation. Readers unfamiliar with the Jackson method 
who desire a more detailed discussion can consult Michael Jackson's 1975 textbook (Jackson, 1975). 



Figure E-7. Jackson Data Structure Chart for mode control example. 
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Figure E-8. Jackson Program Structure Chart for mode control example. 


To prepare pseudocode from the program structure chart of figure E-8, the chart is read as follows. 
Starting at the top and working downward, each row is read from left to right. The first operation 
encountered is setting the Init_DONE flag FALSE, which must be taken care of by the operating 
system (compare Operating System Initialization, table E-l ). Working downward and to the left into 
the application program (compare Subroutine Flight Control Mode Selection, table E-l), the second 
row consists of two mutually exclusive alternatives (note the small circles at the upper right in each 
block), of which the first is “Process the first frame producing MODE A." The two alternatives are 
distinguished by testing the lnit_DONE Hag. On the first frame, two operations must be carried out 
(see the two large circles below the first-frame block referring to Note 3 and Note 2). Reading from 
left to right, first the system must be initialized by selecting MODE A, and then the Init_DONE flag 
must be set TRUE, causing the initialization to be skipped on all subsequent frames. The pseudocode 
specified by the diagram of figure E-8 is as follows, from the top down to and including the second 
row of the application program. The numbers in parentheses following each action to be performed 
refer to the Notes on the Jackson chart (fig. E-8). 


E-l 3 


Operating System Initialization 


Set Init_DONE flag FALSE ( I ) 


Subroutine Flight Control Mode Selection 


Called from Foreground 


IF (not Init_DONE) THEN 


First frame 


Select MODE A (3) 

Set Init_DONE flag TRUE (2) 


ELSE 


All subsequent frames 


Process other frames 


END IF 


RETURN 


The processing required during subsequent frames is specified by the lower two rows of the applica- 
tion program structure chart. Continuing to work downward and to the left, the third row consists of 
three mutually exclusive alternatives, which are distinguished by testing the mode selected during 
the previous frame, beginning with MODE A. If MODE A was selected, the bottom row requires test- 
ing the conditions to distinguish among the three mutually exclusive alternatives shown. The block 
at the extreme left of the bottom row specifies that, if condition 1 is FALSE, then MODE A must be 
selected again for the current frame (Note 3). The next block to the right specifies that, if condition 1 
is TRUE and condition 2 is FALSE, first action (a) must be performed (Note 6), and then MODE B 
selected (Note 4). The third block specifies that, if both condition 1 and condition 2 are TRUE, first 
action (b) must be performed (Note 7), and then MODE C selected (Note 5). 

Since there are no other blocks to the right in the last row under the block “Process MODE A” in the 
third row, this completes the MODE A processing. Now moving up to the third row, it can be seen 
that the next block to the right specifies the processing for MODE B, and the last block specifies the 
processing for MODEC. At this point, the pseudocode is as shown in table E-2. 

It will be seen that the mutually exclusive alternatives in the program structure chart are translated 
directly into the standard IF... ELSE IF structures in the pseudocode. This direct structural correspon- 
dence between chart and pseudocode, which is made possible by the use of standard structural 
forms, is fundamental to the Jackson method. 

In table E-2, the stubs for processing MODE B and MODEC are completed in the same manner as that 
just explained for MODE A. The processing for MODE B and MODE C completes the processing for the 
third row (fig. E-8). Moving up to the second row, it can be seen that processing is now complete for 
the block “Process other frames” at the right of the second row, and also for the block “Process 
frame producing mode” in the first row. Moving to the right in the first row, the last operation is 
specified by Note 8, RETURN. 
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TABLE E-2 


Operating System Initialization 

Set Init_DONE flag FALSE (1 ) 

Subroutine Flight Control Mode Selection ! Called from Foreground 

IF (not lnit_DONE) THEN ! First frame 

Select MODE A (3) 

Set Init_DONE flag TRUE (2) 

ELSE 

IF (MODE A) THEN 

IF (not Condition I) THEN 
Select MODE A (3) 

ELSE IF (Condition 1 and not Condition 2) THEN 
Perform Action (a) (6) 

Select MODE B (4) 

ELSE IF (Condition 1 and Condition 2) THEN 
Perform Action (b) (7) 

Select MODE C (5) 

END IF 

ELSE IF (MODE B) THEN 
Process MODE B 

ELSE IF (MODE C) THEN 
Process MODE C 


! Process MODE B 
! Process MODE C 


! All subsequent frames 
! Process MODE A 


END IF 


END IF 
RETURN (8) 


The program is now complete. The complete pseudocode (table E-2) is found to correspond exactly 
to that prepared directly from the modified statechart (table E-l), showing that, for this example, the 
method based on the proposed statechart modification is equivalent to the well-established Jackson 
program design method. 
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APPENDIX F 

THEOREMS ON SYSTEM BEHAVIORAL PROPERTIES 


Volume I presents a new method for synthesizing hybrid systems from design requirements, and 
applies it to the design of a system for longitudinal control of transport aircraft. The resulting system 
satisfies general requirements for safety and effectiveness specified a priori. This appendix presents 
theorems that summarize the behavioral properties of the hybrid system (Volume I, (Synthesis of 
Altitude Command Supermode)), and provides methodology for generating formal proofs. These 
theorems enable theoretical assessment of system dynamical behavior and verification of system 
safety and effectiveness independent of the synthesis method. By this means, formal validation of 
the complete system can be achieved. 

The discussion begins with some considerations of proof methodology, followed by the theorems 
themselves and their proofs. For clarity, an informal proof outline is presented immediately before 
each formal proof. A short discussion shows by example how a rather subtle design error committed 
during the synthesis process was revealed by attempted formal proof and subsequently corrected. 

Finally, it is shown that currently available codes for automated hypothesis testing can provide the 
basis for a theorem-proving tool. By this means, any hypothesis could in principle be tested to 
determine whether it is a theorem of the formal system. In future system development making use 
of the synthesis methods described in this report, such hypothesis testing could play a role similar to 
that of simulation in today's development process, but unlike simulation it would lead to results that 
would be rigorous and logically complete. 


PROOF METHODOLOGY 
Objectives 

Several of the theorems to be discussed describe system dynamical behavior, such as capture of 
altitude and airspeed targets, that is inherently time-dependent. The time required for capture of a 
new target depends on the initial conditions prevailing at mode engagement, and ranges from a few 
seconds for a small change of airspeed to more than 30 minutes required for the aircraft to climb and 
capture the cruising altitude following system engagement just after takeoff (appendix B). Therefore, 
any attempt to characterize such time variations precisely would lead to an extremely complicated 
analysis, with correspondingly complex theorems and formal proofs. 

Fortunately, that effort is unnecessary. In our opinion, variations in the time required for target 
capture are unimportant for formal assessment of system behavior, for two reasons: first, the human 
flight crew will know roughly what variations to expect based on simulator training and flight exper- 
ience; and second, this rough knowledge is adequate for supervision of the automated system, just as 
it is for supervision of a human crewmember during manual flight. What is essential for supervision 
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is assurance that the system cannot fail to capture a selected target without generating an appropriate 
warning. Therefore, the theorems to be discussed can be regarded as guarantees of system behavior 
offered to the flight crew by the system designers. 

Approach 

This viewpoint suggests a simplified approach to the formal description of system behavior. By 
ignoring time-dependent detail, the essential behavior can be stated formally by logical propositions 
of the form (A B C => D), where A denotes selection of a primitive mode, B denotes selection of a 
valid target, C denotes satisfaction of a guarding condition, and D denotes capture of the selected 
target in the long term after some unspecified time has elapsed. For example, let A denote selection 
of the primitive y-V Command mode described in Volume I, B denote selection of valid flightpath 
and airspeed targets, C denote absence of thrust saturation (table 3, Volume I), and D denote 
(eventual) capture of the selected flightpath and airspeed targets. The proposition (A B C => D) 
then has the semantic interpretation that continuous engagement of the y-V Command mode AND 
continuous selection of the (fixed) flightpath and airspeed targets AND continuous absence of thrust 
saturation IMPLY eventual capture (and hold) of the selected flightpath and airspeed targets. 

It should be noted that the truth value of the proposition ( A B C => D) depends only on the stability 
properties of the flightpath and airspeed regulators, which are continuous elements of the hybrid 
system. Their stability properties characterize the closed-loop dynamical behavior of the aircraft 
with the y-V Command mode engaged, as discussed in detail in Volume 1. Regulator stability, which 
is governed by continuous differential equations, can be verified by well-known control-theoretic 
methods independent of the discrete mode selection logic. In this example, the mode selection logic 
determines the truth values of the conditions A, B. and C, but not the truth value of the implication 
(A B C => D), which depends only on regulator stability. 

It follows that, after independent verification, the proposition (A B C => D) can be taken as an axiom 
of the formal system that describes the essential dynamical behavior of the y-V Command mode. 
Other axioms similar in form can describe the essential dynamical behavior of the other primitive 
modes (that is. the y Command mode and the V Command mode). Ordinary propositional logic 
(appendix D), which is inherently static in nature because it deals with propositions whose truth 
values are independent of time, can then be applied to these axioms (together with other system 
properties to be defined in the next section) in order to establish formally the dynamical behavior of 
the complete system. 


Framework of Analysis 

The mode structure of the complete system is organized hierarchically on three levels, as explained 
in detail in Volume I. On the first level, the three primitive modes (whose dynamical behavior is 
summarized by the axioms just discussed) are combined to form the lowest-level supermode, which 
is termed Path/Speed Command. The mode selection logic for the Path/Speed Command supermode 
determines which one of the three primitive modes is engaged at any time, and must provide an 
appropriate strategy for switching between them as flight conditions change. On the second level of 
the mode hierarchy, higher-level supermodes accept altitude and airspeed targets entered manually 
into the aircraft mode control panel by the flight crew, generate appropriate flightpath and airspeed 
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targets, and select the first-level Path/Speed Command supermode, which becomes an internal 
element of the higher-level supermode that invokes it. (The third level of the hierarchy, which is not 
treated in detail by this report, enables aircraft trajectories to be optimized to conserve time and fuel 
by appropriate automated selection of altitude and airspeed targets.) The dynamical evolution of all 
the modes in this hierarchy constitutes the system behavior that must be summarized by the theo- 
rems to be presented. 

For analysis, this dynamical mode evolution is considered to be composed of piecewise-continuous 
segments, each of which is characterized by a set of modes and supermodes on different levels of the 
hierarchy that remain selected throughout the (unspecified) time duration of that segment. The seg- 
ments are separated by well-defined mode transitions, which occur instantaneously in accordance 
with the convention of broadcast synchronization (appendix E). 

At each mode transition, mode selection for the next segment depends only on (1) the set of modes, 
supermodes, and targets selected for the current segment, and on (2) currently prevailing flight 
conditions (specifically, flightpath angle, airspeed, and thrust). Mode selection is independent of the 
past history of mode selection previous to current selections, and of flight conditions previous to 
prevailing conditions (the Markovian property). The continuous variables representing prevailing 
flight conditions are discretized for mode selection by separating the flightpath-airspeed plane into 
7 regions (termed geometric stability regions) with mathematically sharp boundaries. These boun- 
daries correspond to minimum airspeed, maximum airspeed, minimum thrust, maximum thrust, and 
speed for minimum drag, which are estimated on board the aircraft based on real-time sensor 
measurements and on stored aircraft performance data. Detailed discussion of this mode selection 
logic can be found in Volume 1. 

The following discussion shows that the system behavior theorems to be presented can be estab- 
lished formally by applying propositional logic to this structural framework. 


DEFINITIONS 
Logical Symbols 

Logical symbols are defined as follows (List of Symbols, Volume 1): 

Equivalence = Negation — i Implication => 

Logical OR u Logical AND will be omitted 

Elementary Theorems 

A reference list of theorems in symbolic logic can be found in appendix D (Dromey, 1989; Bartee, 
1985). For example. Theorem 17 is referenced as follows: 

(17) p q => p 
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Symbolic Logical Propositions 


For reference, the following definitions are taken from Volume I: 


V1 ^ V m,ndrag> 

VT7 = (V < V ) 

v TGT _ MIN DRAG ’ 

V3s < V = V tgt> 

V4 = (V> V ) 

v TGT 7 

o 

III 

II 

o 

GT 6 = (7 >7 ) 

VI TGT 'POT MAX ' 

P = (y >y ) 

W TGT 'SPEED MAX ’ 

O = (7 <7 ) 

V W TGT 'SPEED MIN 7 

DC1 = (7 POTM | N <0) 

PF1 = (7 =7 ) 

v ' POT MAX 'POT MIN 7 

TCI "<V,t M ax <0) 

TC2 = (7 =0) 

TS1 = (7 < 7 speed M)n ) 

TS2 = (7 > 7 ) 

TT1 = (7 =7 ) 

v ' POT TGT ' POT MIN ’ 

TT2 = (7 =7 

v ' POT TGT ‘ POT MAX 


nPE (y) = (GT6 VI TS2) 


iPE (V) = (P TT1) u (Q TT2) 


iPP = (PRIORITY = SPEED) PP = (PRIORITY = PATH) 

Mode Selection Strategy 


Denote mode selection by the following symbols: 

AC = Altitude Command supermode 

CH = Altitude Capture / Hold supermode CD = Climb / Descend supermode 
CM = Climb supermode DM = Descend supermode 

PS = Path / Speed Command supermode 
VC = V Command mode GC = y Command mode 
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Path/Speed Command Supermode Selection 

The primitive mode selection logic for the Path/Speed Command supermode can be summarized as 
follows (table 7, Volume I): 


PS -,PP => VC 


PS PP => GC 


Altitude Command Supermode Selection 

The supermode selection logic for the Altitude Command supermode can be summarized as follows 
for the abnormal cases (table 12, Volume I): 

AC — iPE ( 7 ) => CD AC PE ( 7 ) — iPE( V) => CH 

The supermode selection logic for the Altitude Capture/Hold supermode and the Climb/Descend 
supermode within the Altitude Command supermode can be summarized as follows (table 10, 
Volume I). (Note that (AH < 0) s (H > Hjgt) and (AH > 0) = (H < Htgt)-) 

CD (H > H_„_) => DM ^PP PS CD (H < H) => CM -nPP PS 

TGT TGT 

CH => PP PS 

Combining the selection logic for the supermodes within the Altitude Command supermode with 
that for the Altitude Command supermode itself results in the following combined selection logic: 

AC -iPE ( 7 ) => CD ^PP PS AC PE ( 7 ) ^PE( V) => CH PP PS 


Drag Condition 

The following property holds for all transport aircraft (Volume I (Flight Control System)): 

DC1 ^potm,n<°) 


Thrust Condition 

During total propulsion failure, the following properties hold (Volume I (Flight Control System)): 
T = T 7 =7 7 =7 

MAX MIN ' POT MAX 'POTM1N 'SPEED MAX 'SPEED MIN 

Therefore, from the definitions of PF1, TCI, and DCI, the following property holds: 

PF1 => (TCI = DC1) 

In the absence of total propulsion failure, the following properties hold (Volume I (Flight Control 
System)): 


T > T 

MAX MIN 


1 POT MAX 


>7 


POT MIN 


7 >7 

' SPEED MAX ' SPEED MIN 
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Therefore, from the definitions of PF1 , TS1, TS2, TT1 , and TT2 the following properties hold: 

— ,PF1=>(7 >7 )(7 >7 ) 

' * POT MAX ‘POT MlNr v 'SPEED MAX 'SPEED MIN ' 

— iPFl => (TS2 = — iTSl)(TT2 = — >TT1) 

Strategy for Setting Target Thrust 

When thrust is saturated, the strategy for setting target thrust can be summarized as follows (table 5, 
Volume 1): 

PF1 => TT1 — iTT2 — iPFl TS1 => TT1 -.TT2 ^PFl TS2 TT2 -iTTl 


From the definitions already stated, these implications are equivalent to the following propositions: 

(7 < 7 ) => (7 =7 ) 

w 'SPEED MIN ' v * POT TGT 'POT MIN ' 

(7 > 7 ) => (7 =7 ) 

V| ' SPEED MAX ' w POT TGT ' POT MAX / 


Speed Regulator 

The parameter Yspeed is defined as follows (Volume 1 (Flight Control System)): 

[TT2 = (7 =7 )]=>(7 =7 ) 

[TT1 = (7 =7 )] => (7 =7 ) 

L ' POT TGT 'POT MIN /J v 'SPEED ' SPEED MIN ’ 

Because the acceleration command (dV/dt)cMD is assumed proportional to airspeed error (Volume 
(Flight Control System)), (dV/dt)cMD vanishes when V = Vjgt- 

The speed regulator has the following properties (Volume 1 (Flight Control System) and figure 
11 (c)): 


(y =7 )=>IV3 = (V = V )1 

v ' SPEED MAX ' POT MAX ’ 1 v TGT n 


f V3 = (V = V )1 => (7 =7 ) 

1 ' v TGT /J w SPEED MAX ' POT MAX / 

(7 >7 )=>[V4 = (V>V )] 

v 'SPEED MAX 'POT MAX ’ 1 v TGT /J 

[V4 = ( V > V )]=>(7 >7 ) 

l V TGT /J v 'SPEED MAX ' POT MAX ' 
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Longitudinal Acceleration Limiter 

The longitudinal acceleration limiter has the following property (Volume I (Flight Control System)): 

(7 < 0 ) 

1 SPEED MIN 7 

Height Regulator 

The height regulator has the following property (Volume I (Synthesis of Altitude Command Super- 
mode) and figure 1 1(b)): 

( 7 tgt < 0 ) ^ ( H >H tg T ) 

Definition of H MA x 

By definition of the maximum altitude H M ax, the following property holds (Volume I, (Synthesis of 
Altitude Command Supermode)): 

(HSH MAX ) ^ ( T , TOT a0 ' 3de 8 ) 


Subscripts 


Subscripts denote conditions prevailing at different times, as follows: 

0 Initial conditions 
C Conditions at capture of Vjgt 

Logical propositions without subscripts hold at all times. Specialization of such unrestricted 
propositions to particular conditions is indicated by the properties 

(•) => (*)o (•) => (»)c 

which follow from the subscript definitions because any proposition which holds in general must 
hold at any particular time. 


The properties 


Fixed Speed and Altitude Targets 


VT = (V TGT = V TGT0 ) HT = (H tgt = H tgto ) 

hold if and only if the speed target V T gt and the altitude target Htgt remain fixed at their initial 
values. 
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V Command Capture Axiom 


The eventual capture of flightpath and airspeed targets after some unspecified time has elapsed 
following engagement of the primitive V Command mode can be expressed by the axiom 

VC HT VT => (7 C = 7 speedc ) V3 c 


which follows from the stability of the flightpath and airspeed regulators (Volume 1, figs. 1 1(e) and 
1 1(c)). (Regulator stability can be verified independently by well-known control-theoretic methods.) 

V Command Hold Axiom 

Following capture, continuous engagement of the V Command mode ensures that the conditions 
(y = Yspeed) and (V = Vjgt) continue to hold indefinitely. This property can be expressed by the 
axiom 


VC HT VT (7 =y ) V3 =>(v = v ) V3 

V)r c 'SPEED C ^ C '’SPEED ' 

which follows from the stability of the flightpath and airspeed regulators (Volume I, figs. 1 1 (e) and 
1 1 (c)). (Regulator stability can be verified independently by well-known control -theoretic 
methods.) 


PERFORMANCE DEGRADATION 

The first theorem to be presented (Theorem I ) shows that the abnormal condition — PE (y) — iPE ( V) 
can occur only if performance has become so degraded that maximum thrust is insufficient for 
steady level fight. (This condition could be encountered following engine failure at cruising alti- 
tude.) Lemma A treats the case of total propulsion failure, and Lemma B treats its absence. 

Lemma A 

PF1 TCI 


Informal Proof Outline 

By definition of total propulsion failure, the property 

PFl=(y = y ) 

w POT MAX ' POT MIN ’ 

holds following total propulsion failure. By hypothesis, PF1 holds. Since Ypotmax then coincides 
with Ypotmin, it follows from their definitions that the equivalence 
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TCI * 'I'POT MAX < 0) = ^POT M,N < 0) ' 00 


holds. But the property DC1 = (Ypotmin < 0) holds for all transport aircraft (Volume I (Flight 
Control System)). Therefore, the property TCI = (Ypotmax < 0) holds following total propulsion 
failure, and the lemma is established. 

Formal Proof 


1. PF1 => (TCI =DCI) 

2. PFI 

3. TCI =DC I 

4. DC1 

5. TCI 


Thrust condition property 
during total propulsion failure. 

Hypothesis. 

Lines I and 2. 

Drag condition. 

Lines 3 and 4. QED 

Lemma B 


— iPFl — .PE(y) — iPE(V) => TCI 


Informal Proof Outline 

By definition. —.PE (y) = (GT6 V I TS2). Since -iPE (y) holds by hypothesis, in particular the 
property TS2 = (y> Yspeedmax) must hold. By definition of total propulsion failure, the condition 
(TS2 = -iTSl)(TT2 = -iTTl) holds in its absence, as required by the hypothesis. Therefore, since TS2 
holds, — .TS 1 must hold. According to the strategy for setting target thrust, the property TT2 holds 
after thrust is set, and TT1 cannot hold. 

From the definition of —.PE (V) — iPE (V) = (P TT1 ) u (Q TT2), which holds by hypothesis, 
and from the conditions -iTTl and TT2 just established, it follows that the condition 
Q = (Ytgt ^ Yspeedmin) must hold. Combining this condition with the property of the longitudinal 
acceleration limiter (Yspeedmin < 0) shows that the condition (Ytgt ^ Yspeed min < 0) must hold. 

Since the condition — iPE (y) = (GT6 V I TS2) holds by hypothesis, in particular the property 
GT6 = (Ytgt ^ Ypot max) must hold. Now, combining this condition with the condition 
(Ytgt ^ Yspeedmin < 0) just established shows that the condition 

(y <y <y <0) 

1 POT MAX 'TGT * SPEED MIN ’ 

must hold. But then in particular the property TCI = (Ypotmax < 0) must hold, and the lemma is 
established. 
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Formal proof 


1 . — iPE (y) = (GT6 V 1 TS2) 

Definition of — iPE (y). 

2. -iPF 1 — iPE (y) 

Hypothesis. 

3. — iPF 1 TS2 

Lines 1 and 2. 

4. — iPE I TS2 => TT2 — ,TT 1 

Thrust setting strategy. 

5. TT2 — iTT 1 

Lines 3 and 4. 

6. — iPE (V) = (P TT 1 ) u (Q TT2) 

Definition of — iPE (V). 

7. — iPE (V) 

Hypothesis. 

8. (P TT1) u (Q TT2) 

Lines 6 and 7. 

9. Q 

Lines 5 and 8. 

10. Q = (yrGT ^ ySPEED min) 

Definition of Q. 

1 1 . (yrGT ^ ySPEED min) 

Lines 9 and 10. 

12. (ySPEED MIN < 0) 

Property of longitudinal 
acceleration limiter. 

1 3. (yrGT ^ ySPEED MIN < 0) 

Lines 1 1 and 12. 

14. GT6 

Lines 1 and 2. 

1 5. GT6 = (yrGT ^ ypoT max) 

Definition of GT6. 

1 6. (yrGT - 7 pot max) 

Lines 14 and 15. 

1 7. (y PO T MAX ^ yrGT ^ ySPEED MIN < 0) 

Lines 13 and 16. 

1 8. (y P oT max < 0) 

( 1 7) p q => p and Line 1 7. 

19. TC 1 = (ypoT MAX < 0) 

Definition of TC 1 . 

20. TCI 

Lines 18 and 19. 


QED 
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Theorem 1 (Performance Degradation Theorem) 


Statement 

-.PE(y)-iPE (V)=>TC1 

Informal Proof Outline 

There are two cases: (a) total propulsion failure present, or (b) total propulsion failure absent. 

Case (a)- Assume that total propulsion failure is present. In that case, according to Lemma A, the 
condition TCI = (Ypot max < 0) holds, and the theorem is established for case (a). 

Case (b)- Assume that total propulsion failure is absent. In that case, according to Lemma B, if both 
PE (y) and PE (V) are violated, then the condition TCI = (Ypotmax < 0) holds. Since by hypothesis 
both PE (y) and PE (V) are violated, the condition TCI = (Ypotmax < 0) must hold, and the theorem 
is established for case (b). 


Therefore, the condition TCI = (Ypotmax < 0) holds whether or not total propulsion failure occurs. 


and the theorem is established in general. 

Formal Proof 

1. PF1 => TCI 

2. — iPF 1 — iPE (Y) — iPE (V) => TC 1 

3. -,PE (y) -.PE (V) 

4. — iPF 1 => TCI 

5. (PF1 u — iPFl ) => TCI 

6. (PF1 u — iPF 1 ) 

7. TCI 


Lemma A. 

Lemma B. 

Hypothesis. 

( 1 3) p T = p and Lines 2 and 3. 

Lines 1 and 4. 

(4) (p u -.p) = T. 

Lines 5 and 6. QED 


RECOVERY FROM ABNORMAL CONDITIONS 

The next three theorems (Theorem 2, Theorem 3, and Theorem 4) to be presented are concerned 
with recovery from the three abnormal conditions for the Altitude Command supermode. As dis- 
cussed in Volume I (table 1 I ), these abnormal conditions are —.PE (y) — iPE (V) —.PE (y) PE (V), and 
PE (y) -.PE (V); the normal condition is PE (y) PE (V). The point of the three recovery theorems is 
to show that, starting from any of the three abnormal conditions, the system recovers to the normal 
condition without crew intervention. If recovery to the normal condition should be precluded by 
performance limitations, then it is demonstrated that the aircraft stabilizes in a desirable flight condi- 
tion and that no potentially unsafe behavior results. 
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Because all three recovery theorems involve dynamical behavior, their proofs are more complex and 
difficult than the proof of the static theorem (Theorem 1) already presented. The discussion begins 
with a (static) lemma that specifies initial conditions for the — PE (y) — PE (V) Recovery Theorem 
(Theorem 2) that hold in the absence of total propulsion failure. 

Lemma C 


— iPFl — iPE(y) — iPE(V) => 


(a) 

(b) 

(c) 

(d) 


(7 < y <y 

' 1 POT MAX 1 TGT 'SPEED MIN 
^SPEED MIN < TsPEED MAX " ^ 
( V TGT <V ^ V M,NDRAG> 

( H > H tgt> 


<0) 


Informal Proof Outline 

Part (a)- The hypothesis coincides with that of Lemma B. The first claim is established by Line 17, 
Lemma B. 

Part (b)- By hypothesis, the condition — iPE (y) = (GT6 VI TS2) holds. In particular, the condition 
TS2 = (y > ysPEED max) holds. Since -,PF 1 => (yspEED max > Yspeed min) holds by the thrust condition 
property, and since — .PF 1 holds by hypothesis, (yspEED max > yspEED min) must hold. Combining this 
with TS2 shows that (yspnED min < ysPEED max ^ y) must hold, establishing the second claim. 

Part (c)- The condition (ypoT max ^ ytGT ^ Yspeed min < 0) holds by Part (a) and the condition 
(yspEED min < yspEED max ^ y) holds by Part (b). Combining these conditions shows that the condition 
(yspEED max > ypoT max) must hold. By the property of the speed regulator, the implication 
(ysPEED max > ypoT max) => (V > V T gt) holds. Therefore, the condition (V > Vjgt) holds. By 
hypothesis, -iPE (y) s (GT6 V 1 TS2) holds. In particular, VI = (V < V M in drag) holds. Combining 
the conditions (V > Vjgt) and (V < V M in drag) shows that the condition (V T gt < V< V M in drag) 
holds, establishing the third claim. 

Part (d)- The implication (yrGT < 0) => (H > H T gt) holds by the height regulator property, and the 
condition (yrGT < 0) holds by part (a). Therefore, the condition (H > Hjgt) must hold, establishing 
the fourth claim. 

Therefore, the lemma is established. 

Formal Proof 


Part (a) 

1 . — iPFl — iPE(y) — iPE(V) => (ypoTMAX ^ yrGT ^ Yspeed min < 0) Line 17, Lemma B. 

2. — iPFl -nPE(y) -iPE(V) Hypothesis. 


3. (y 


POT MAX 


< 'V <7 
— I TGT — l 


SPEED MIN 


<0) 


Lines 1 and 2. 
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Part (b) 

4. — iPE( 7 ) = (GT 6 V 1 TS2) 

Definition of — iPE( 7 ) 

5. TS2 

lines 2 and 4. 

6 . TS2 = (7 > y ) 

w * SPEED MAX ' 

Definition of TS2. 

7. (7 >7 ) 

v ' 'speed max' 

Lines 5 and 6 . 

8. — ,PFl=>(y >7 ) 

v 'speed max 'speed min ’ 

Thrust condition property. 

9. (7 >7 ) 

v ' SPEED MAX ' SPEED MIN 

Lines 2 and 8 . 

10. (7 <7 < 7 ) 

v ' SPEED MIN ' SPEED MAX ' 

Lines 7 and 9. 

Part (c) 


II. (7 >7 ) => ( V > V ) 

Speed regulator property. 

12 . (7 <7 ) 

Line 3 

13. (7 <7 ) 

v ' POT MAX 'SPEED MAX ’ 

Lines 9 and 10. 

14. (V>VJ 

v TGT 

Lines 1 1 and 13. 

15. VI 

Lines 2 and 4. 

16. VI =(V< V ) 

v MIN DRAG ’ 

Definition of VI. 

17. (V< V ) 

v MIN DRAG ' 

Lines 15 and 16. 

18. (V < V< V ) 

v TGT MIN DRAG ’ 

Lines 14 and 17. 

Part (d) 


19. ( Ytot < 0)^(H>H tot ) 

Height regulator property. 

20. <H>H tgt ) 

Lines 3 and 19. QED 


The next lemma establishes initial mode selection for the initial conditions of Lemma C. 
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Lemma D 


(a) AC -nPE(Y) => CD -nPP PS VC 


(b) AC — iPFl ^PE(y) — iPE( V) => CD DM ^PP PS VC 


Informal Proof Outline 

Part (a)- The implication AC — iPE (y) => CD — iPP PS holds by the property of the Altitude Com- 
mand supermode selection logic. Since AC — iPE (y) holds by hypothesis, the condition CD — >PP PS 
must hold. The implication — iPP PS => VC holds by the property of the Path/Speed Command super- 
mode selection logic. Since — iPP PS holds, VC must hold. Combining these results shows that 
CD — iPP PS VC must hold, establishing the first claim. 

Part (b)- The implication — iPFl —.PE (y) —.PE (V) => (H > Htgt) holds by Lemma C, and the 
condition AC — .PF 1 —.PE (y) —.PE (V) holds by the hypothesis of part (b). Therefore, the condition 
(H > Hjgt) must hold. But the implication CD (H > Htgt) => DM holds by the property of the 
supermode selection logic within the Altitude Command supermode, and AC CD (H > Htgt) holds. 
Therefore DM holds (the Descend supermode is selected). Combining this result with that of part (a) 
shows that the condition CD DM — .PP PS VC holds, establishing the second claim. 

Therefore, the lemma is established. 

Formal Proof 


Part (a) 


3. CD -iPP PS 


2. AC — iPE(y) 


AC — .PE(y) => CD — .PP PS 


Altitude Command supermode 
selection property. 

Hypothesis. 

Lines 1 and 2. 


4. ^PPPS^VC 


5. CD — .PP PS VC 


Path/Speed Command 
supermode selection property. 

Lines 3 and 4. 


Part (b) 

6. AC — .PF1 -iPE(y) => CD — .PP PS VC 


Part (a). 


7. AC — .PFl — iPE(y) — >PE(V) 


Hypothesis of Part (b). 


8. CD -.PP PS VC 


Lines 6 and 7. 


9. — iPFl -.PE(y) -iPE(V) => (H > H tgt 


Lemma C, part (d). 
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Lines 7 and 9. 


10. (H>h tct ) 

1 1 . CD (H > H ) => DM Altitude Command supermode 

TGT 

selection property. 

12. CD DM — iPP PS VC Lines 8, 10, and 1 1. QED 

Initial Conditions for -.PE (y) -PE (V) Recovery 

To summarize the initial conditions implied when — PE (y) — PE (V) holds, the conditions on yrcr, V, 
and Vtgt specified by Lemma C severely constrain the location of the initial (V, Ytgt) point within 
the (V, ^gt) plane. The situation is illustrated qualitatively by figure F-l, which can be constructed 
from the specification of Lemma C together with the definitions of —.PE (y) and —.PE (V). The initial 
point must be located within the shaded area (fig. F-l). Furthermore, upon engagement of the Alti- 
tude Command supermode the primitive V Command mode is selected, as required by Lemma D. 
During the first segment of the subsequent mode evolution, the (V, Ytgt) point follows a trajectory 
in the (V, Ytgt) plane (fig. F-l) that is determined by the initial (V, y) operating point and by the 
V Command regulator law, as discussed in Volume I. The resulting dynamical behavior of the 
system can be analyzed informally as follows. 


V MIN DRAG 



The shaded area indicates the initial operating point. 

Figure F-1 . Conditions for -.PE (y) -.PE (V) recovery. 
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Dynamical Analysis 


The system attempts to capture Yspeed max and then to capture Vjgt by decelerating along the 
Yspeedmax contour. Consider first the Yspeed max capture maneuver. According to Lemma C, the 
condition (Y^ Yspeedmax) holds initially, but since Yspeedmax is not specified it could take either 
positive or negative values. Therefore, the aircraft could either climb or descend initially. According 
to Lemma C, the condition (H > Hjgt) holds initially. If the aircraft climbs away from the target 
altitude, it follows from the height regulator law (Volume I, fig. 1 1 (b)) that Ytgt must decrease. 

If the aircraft descends, then Ytgt must increase. Since the condition (Y> Ypotmax) holds initially 
(Lemma C, parts (a) and (b)), it follows from the longitudinal equation of motion (equation ( lc). 
Volume I (Aircraft Model)) that the longitudinal acceleration is initially negative, so that the speed 
must decrease. Since V must decrease initially, but Ytgt could either increase or decrease, it can 
be seen from figure F-l that transitions are possible from the shaded region where the condition 
— iPE (y) — iPE (V) holds to regions where either the condition — iPE (y) PE (V), the condition 
PE (y) -iPE (V), or the normal condition PE (y) PE (V) holds. There are therefore three possible 
recovery cases. 

Furthermore, both figure F-l and Lemma C, part (c), also show that the initial condition 
— iPFl — iPE (y) — iPE (V) cannot continue to hold at V = Vtgt- Therefore, one of the three possible 
recoveries must occur before V TG t is captured. If either the PE (y) — >PE (V) or the PE (y) PE (V) 
recovery occurs, then the Altitude Command supermode selection logic (table 12, Volume I) shows 
that the Altitude Capture/Hold supermode is selected. In that case, either the y Command mode or 
the Y-V Command mode is selected, ending the first segment of the mode evolution. On the other 
hand, if the — .PE (y) PE (V) recovery occurs, the primitive V Command mode remains selected, and 
the first segment continues. We shall continue the analysis of dynamical behavior for this latter case 
of — iPE (y) PE (V) recovery. 

Since the condition — >PE (y) = (GT6 V 1 TS2) continues to hold by assumption, the condition 
TS2 = (Y ^ Yspeed max) must hold, in particular along the Yspeed max contour where the condition 
(Y = Yspeed max) holds. Therefore, TT2 = (Ypottgt = Yspeedmax) remains selected. The definition 
— iPE (V) = (P TT1 ) u (Q TT2) shows that, since PE (V) holds by assumption and TT2 continues to 
hold, Q = (Ytgt ^ Yspeed min) cannot hold. Therefore, the condition -,Q = (Ytgt > Yspeed min) must 
hold. Since this condition can hold at V = Vtgt (fig- F-l), the V Command mode can remain 
selected, and the V Command capture property then ensures capture of Vtgt- At V = Vtgt. the 
condition (Yspeedmax = Ypotmax) holds by the property of the speed regulator. The condition 
TCI = (Ypotmax < 0) holds initially by Theorem 1 (Thrust Degradation Theorem). 

If TCI continues to hold at V = V T gt the aircraft descends steadily in the V Command mode, pass- 
ing through the target altitude without attempting to capture it, although the Climb mode is then 
selected at all lower altitudes. During descent, Ytgt increases monotonically by the height regulator 
property. At V = V T gt. Ytgt is unbounded above (fig. F-l). Therefore, the descent of the aircraft can 
continue indefinitely in the V Command mode. But maximum thrust increases as altitude decreases 
(appendix B). If a lower altitude is reached where (Ypotmax = 0) holds, then the condition 
(y = Yspeed max = Ypot max = 0) holds in the long term, so that the aircraft stabilizes in level flight at 
V = Vtgt without crew intervention. The Climb mode remains selected. (The crew would then be 
expected to select a lower target altitude within the performance capability of the aircraft, which 
would enable the system to recover to the normal condition PE (y) PE (V).) 
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Notice that the diagram of figure F-l plays a role in the foregoing dynamical analysis somewhat 
similar to that of diagrams in Euclidean geometry — such diagrams can aid in discovering a rigorous 
proof, but cannot themselves be used to prove anything directly. Therefore, the kind of informal 
dynamical analysis just presented is suggestive, but not decisive. Nevertheless, the outline of a 
theorem for — iPE (y) — iPE (V) recovery can be seen emerging from the discussion, which can be 
stated informally as follows. 


Informal Statement 

If both PE (y) and PE (V) are violated initially, and if the Altitude Command supermode is selected 
and the target altitude H T gt and the target airspeed V T gt remain fixed, then in the absence of total 
propulsion failure 

(a) the condition (V T gt < V < Vmindrag) must hold initially; 

(b) recovery from the condition — iPE (y) — iPE (V) occurs before Vtgt is captured; 

(c) if the conditions — .PE (y) PE (V) and TC 1 = (ypoT max < 0) hold at capture of Vtgt and 
continue to hold thereafter, then the aircraft stabilizes in descent at V = Vtgt, and the 
V Command mode remains selected; and 

(d) if a lower altitude is reached where the condition (ypoT max = 0) holds in the long term, the 
aircraft stabilizes in level flight at V = V T gt- 

Approach to Formal Proof 

To establish this theorem formally, we shall first construct an informal proof outline based on the 
initial conditions and on the dynamical analysis just presented. The cases corresponding to total 
propulsion failure, to recovery to the condition PE (y) — iPE (V) or PE (y) PE (V), and to the condi- 
tion (ypoTMAX > 0) at V = V T gt, which are ruled out by the hypothesis of the present theorem, can be 
treated by the same method. In constructing the informal proof outline, logical gaps resulting from 
missing definitions of system properties can be ignored temporarily, because they can be filled in 
later by formalizing material from Volume I as necessary. 

Informal Proof Outline 

Part (a)- In the absence of total propulsion failure, the condition — iPFI holds. The implication 


Theorem 2 (-.PE (y) -iPE (V) Recovery Theorem) 


— iPFI — iPE(y) — iPE(V) => 


(7 


POT MAX 



SPEED MIN 


<0) 


(7 


< 7 

SPEED MIN ' SPEED MAX 


<y) AND 



MIN DRAG 


H H>H tgt) 
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holds by Lemma C, and the condition — .PF1 — iPE (y) — tPE (V) holds by hypothesis. Therefore, the 
condition 

(y < y < y < 0) 

v ' POT MAX 1 TCT ' SPEED MIN 

(y < y < AND 

v 'SPEED MIN 'SPEED MAX ” 


(V <V<V ) (H > H ) 

v TGT MIN DRAG ’ v TGT 


must hold. In particular, the condition (Vtgt < V < V M | N drag) must hold, establishing the first 
claim. 

Part (b)-The second claim can be established by means of contradiction. The implication 
AC — .PE (y) => CD — iPP PS VC holds by Lemma D, part (a). Assume that the condition 
AC — iPF 1 — iPE (y) — iPE (V) continues to hold. Therefore, VC holds, so that the primitive 
V Command mode is selected and continues to hold. Since the implication VC => V3c holds by 
the V Command capture axiom and VC holds, V3c must eventually hold when Vtgt is captured. 
Because the condition — iPFl — iPE (y) — iPE (V) holds by assumption, the condition 
(ypoTMAx ^ yrGT ^ ysPEEDMiN < 0) must hold by Lemma C, part (a), and the condition 
(yspnEDMiN < ysPEED max ^ y) must hold by Lemma C, part (b). Combining these conditions, 
the condition (Yspeed max > Ypotmax) holds in general. In particular, the condition 
(ysPEED max c > ypoT max c ) must hold when V TG t is captured. But since the implication 
V3 => (Yspeed max = ypoTMAx) holds by the property of the speed regulator, and since V3c 
eventually holds, the condition (yspEEDMAXc = ypoTMAxc) must hold, contradicting the condition 
(ysPEED max c > ypoT max c) just established. It follows that the assumption that the condition 
AC — iPFl — iPE (y) — iPE (V) continues to hold until Vtgt is captured is false, establishing the 
second claim. 

Part (c)- Since the condition AC -.PF1 —.PE (y) PE (V) HT VT TCI holds at Vtgt capture by the 
hypothesis of part (c), and the implication AC —.PE (y) => CD — .PP PS VC holds by Lemma D. part 
(a), the condition VC must hold, so that the V Command mode remains selected at V TG t capture. 

By hypothesis, the condition — iPE (y) = (GT6 V 1 TS2) holds. In particular, the condition 

TS2 s (y> Yspeed max) holds. In the absence of total propulsion failure, — >PF 1 holds, as required 

by the hypothesis. Therefore, the condition — .PF 1 TS2 holds. According to the strategy for setting 

target thrust, the condition TT2 = (ypoT tgt = ypoT max ) then holds after thrust is set. Therefore, 

the condition (Yspeed = Yspeed max) holds by definition of Yspeed- Since the implication 

VC => (yc = Yspeed c) V3c holds by the V Command capture axiom, and since VC holds, Yspeed 

and Vtgt are captured. Since (Yspeed = Yspeed max) holds, the conditions (y = Yspeed max) and 

V3 = (V = Vtgt) hold at Vtgt capture. Since V3c holds, and since the implication 

V3 => (Yspeed max = Ypot max) holds as a property of the speed regulator, the condition 

(Yspeed maxc = Ypotmaxc) holds. Combining these conditions shows that the condition 

V3 c (yc = Yspeed max c = Ypot max c) holds at Vtgt capture. Furthermore, the condition 

TC 1 = (Ypot max < 0) holds by the hypothesis of part (c). Therefore, the condition V3c (Yc < 0) holds 

at V = Vtgt- This shows that the aircraft descends initially at V = V TG t after Vtgt capture. 
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Since the implication VC (y c = Yspeedc) V3c => (y = Yspeed) V3 holds by the V Command hold 
axiom, and since the condition VC (yc = Yspeedc) V3c holds, it follows that the condition 
(Y = Yspeed) V3 must hold in general after V T gt capture. Since (Yspeed = Yspeed max) also holds, 
the condition VC (y= Yspeed max) V3 must hold. Furthermore, since the implication 
V3 => (Yspeed max = Ypot max) holds as a property of the speed regulator and V3 holds, the 
condition (Yspeed max = Ypot max) holds. Combining these conditions shows that the condition 
VC (y= Ypot max) V3 holds. Finally, since the condition TCI = (Ypot max < 0) holds by the hypothe- 
sis of part (c), the condition (y< 0) VC V3 holds in general after Vtgt capture, establishing the third 
claim. 


Part (d)- By the hypothesis of part (d), the condition (Ypot max = 0) holds in the long term. Since the 
condition (y= Yspeed max = Ypot max) was established by part (c), it follows that the condition 
(Y = Ypot max = 0) holds in the long term. Furthermore, V3 = (V = V T gt) continues to hold by the 
V Command hold axiom. Therefore, the condition (y = 0) (V = Vtgt) holds in the long term. This 
shows that the aircraft eventually stabilizes in level Bight at V = Vtgt, establishing the fourth claim. 

Therefore, the theorem is established. 


Formal Statement of -iPE (y) -.PE (V) Recovery Theorem 

AC — iPFl — iPE(y) () -iPE(V) () HT VT => 

(a) (V < V < V ) AND 

' ' TGT 0 0 MIN DRAG * 


(b) — >[AC — iPFl — ,PE(y) ^PE( V) HT VT] V3 r 


(c) AC — iPF 1 — iPE(y) PE(V) HT VT TCI => (y < 0) VC V3 

(d) AC — iPFl — iPE(y) PE( V) HT VT TC2 => (y = 0) VC V3 


Formal Proof 


Part (a) 


1. — iPFl — iPE(y) — iPE( V ) 
0 (Y 
(b) (y 


Lemma C. 


(a) (y <y <y <0) 

v ; v ‘ POT MAX 'TGT 'speed MIN ’ 


< y < y) 

SPEED MIN 'SPEED MAX " 


(c) (V tct <V<V m|N1)rac ) 

(d) (H>h tgt ) 


nPFl — iPE( y) o — iPE(V) 0 


Hypothesis 
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^pot max o “ ^tgto “ ^ SPEED min o < ^ Lines 1 and 2 and subscript. 

AND ( Wdm.no < Wmaxo-^q ) specialization property 

AND (V < V ^ V ) (H > H ) (•) (»V> 

V TGT 0 0 MIN DRAG ' ' 0 TGTO' V ' V ;0 


Remark- In particular, the condition (V T gto < V 0 < V M in drag) holds, establishing the first 
claim. 


Part (b) 

4. AC — .PE(y) => CD -,PP PS VC 

5. AC — iPF I — iPE(7) -,PE(V) () HT VT 

6. VC 

7. VC HT VT => V3 C 

8. V3 C 

9. (Ypot max ^ Ytgt ^ Yspeed min< 0) 

AND (Yspeed min < Yspeed max ^ Y) 


Lemma D, part (a). 
Assumption. 

Lines 4 and 5. 

V Command capture axiom. 
Lines 6 and 7. 

Lines 1 and 5. 


1 0. (Yspeed max c > Ypot max c) 

1 1 . V3 =i> (Yspeed max = Ypot max) 

1 2. (Yspeed max c = Ypot max c) 

13. -4 AC — iPF 1 ^PE(y) — iPE( V) HT VT] 

14. — i[AC — iPFl — iPE(y) ^PE(V) HT VT] V3 C 


Line 9 and subscript 
specialization property (•) => (»)c. 

Speed regulator property. 

Lines 8 and 1 1 . 

Lines 5, 10, and 12. 

Lines 8 and 13. 


Remark- The contradiction of Lines 10 and 12 shows that the assumption of Line 5 is false. The 
second claim is established by Line 14. 


Part (c) 

15. AC — iPF 1 ^PE(y) PE(V) HT VT TCI 

16. VC HT VT 

17. -hPE(y) = (GT6 V I TS2) 

18. TS2 

19. — iPFl TS2 

20. — iPFl TS2 => TT2 — iTTI 


Hypothesis of part (c). 

Line 15 and Lemma D. part (a). 
Definition of -iPE(y). 

Lines 15 and 17. 

Lines 15 and 18. 

Thrust setting strategy. 
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21. TT2 


Lines 19 and 20. 


22. TT2 => (Yspeed = Yspeedmax) 

23. (Yspeed = Yspeedmax) 

24. VC HT VT => (Yc = Yspeed c) V3c 

25. (Yc = Yspeed max c) V3c 

26. (Yc = Ypot max c) V3c 

27. TC 1 = (Ypot max < 0) 

28. (Ypot max < 0) 

29. (Yc<0) V3 C 


Definition of Yspeed- 
Lines 21 and 22. 

V Command capture axiom. 
Lines 16, 23 and 24. 

Lines 1 1 and 25. 

Definition of TCI. 

Lines 15 and 27. 

Lines 26 and 28. 


Remark- This result shows that the aircraft initially descends at V = Vjgt (that is, at V TG t 
capture and immediately afterward). 


30. VC HT VT => (Yc = Yspeed c) V3c => (Y= YSPEED) V3 V Command hold axiom. 

31. (Y = Yspeedmax) VC V3 Lines 16, 23, and 30. 


32. (Yspeed max - Ypot max) 

33. (y = Ypot max) VC V3 

34. (y< 0) VC V3 


Lines 1 1 and 3 1 . 
Lines 3 1 and 32. 
Lines 16, 28, and 33. 


Remark- This result shows that the aircraft continues to descend at V = Vtgt. establishing the 
third claim. 


Part (d) 

35. AC — iPF 1 -iPE(y) PE(V) HT VT TC2 

36. VC HT VT 

37. ^PE(y) s (GT6 V 1 TS2) 

38. TS2 

39. — iPF 1 TS2 

40. — iPF 1 TS2 => TT2 ->TT1 

41. TT2 

42. TT2 => (Yspeed = Yspeed max) 

43. (Yspeed = Yspeed max) 


Hypothesis of part (a). 

Line 35 and Lemma D, part (a). 
Definition of — iPE(y). 

Lines 35 and 37. 

Lines 35 and 38. 

Thrust setting strategy. 

Lines 39 and 40. 

Definition of Yspeed- 
Lines 41 and 42. 
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44. VC HT VT => (7c = Yspeed c) V3 c 


V Command capture axiom. 


45. (ye = Yspeed max c) V3c 

46. (ye = Ypot max c) V3c 

47. VC HT VT ( 7 c = Yspeedc) V3c => (7= Yspeed) V3 

48. (7 = Yspeed max) V3 

49. (Yspeed max = Ypot max) 

50. (y = Ypot max) V3 

5 1 . (Ypot max = 0) 

52. (Y= 0) VC V3 


Lines 36, 43 and 44. 


Lines 1 1 and 45. 


V Command hold axiom. 


Lines 36, 45, and 47. 


Lines 1 1 and 48. 


Lines 48 and 49. 


Line 35 and definition of TC2. 


Lines 36, 50, and 57. QED 


Remark- This result shows that, if the condition (Ypot max = 0) holds in the long term, the 
aircraft eventually stabilizes in level flight at V = Vtgt, establishing the fourth claim. 

Therefore, the theorem is established. 


Formal proof of the — iPE ( 7 ) —.PE (V) Recovery Theorem (Theorem 2) is long and complex even 
though the theorem has been stated in a weak form: the total propulsion failure case has been 
excluded, and likewise the cases of recovery to the conditions PE ( 7 ) — iPE (V) and PE ( 7 ) PE (V), as 
shown by the dynamical analysis presented previously. Despite these simplifications, formal proof 
of the — iPE ( 7 ) — iPE (V) Recovery Theorem, together with its auxiliaries Lemma C and Lemma D. 
require a total of 84 steps. Formal proof of the Performance Degradation Theorem (Theorem 1) 
together with Lemma A and Lemma B previously required 36 steps, making a total of 120 steps for 
the formal proofs of the theorems presented thus far. Furthermore, three theorems involving 
complicated dynamical behavior remain to be proved. 

In our opinion, the development of formal proofs such as that just presented for the — iPE ( 7 ) — iPE (V) 
Recovery Theorem (Theorem 2) by means of manual pencil-and-paper methods would be too com- 
plex and laborious for routine use by the aircraft industry. On the other hand, informal proofs of the 
kind outlined may not be sufficiently rigorous to provide an independent check of the integrity of the 
synthesis process, as indicated by failure to reveal omission through oversight of a total propulsion 
failure case to be discussed later. A potential resolution of this dilemma might be achieved by using 
currently available theorem-proving software (Rushby, 1999; Schumann, 2001) to generate formal 
proofs. To enable such machine-generated formal proofs to be checked manually if desired, a 
sequential listing of the detailed steps (together with their justifications) should be provided for each 
proof by the theorem-proving software. 

The development of practical working methods for formalizing informal proof outlines is currently 
being investigated. The First step is to formalize the definitions of system properties suggested by 


Proof Automation 
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the informal proof outline, as already illustrated for the — PE (y) —.PE (V) Recovery Theorem 
(Theorem 2). Some iteration of this first step may be required during attempts at formal proof 
(Lakatos, 1976). Development of methods for automating formal proofs remains incomplete, and 
only informal proof outlines will be offered for the three theorems to be presented next. In the 
meantime, these informal proof outlines, while not rigorous, can be regarded as making the 
existence of rigorous formal proofs plausible. 

Theorem 3 (PE (y) -iPE (V) Recovery Theorem) 


Informal Statement 

If PE (V) is violated initially, but PE (y) holds, and if the Altitude Command supermode is selected 
and the target altitude Hjgt remains fixed with Htgt ^ Hmax, then in the absence of total propulsion 
failure PE (y) PE (V) must eventually hold. 

Informal Proof Outline 

By hypothesis, the condition PE (y) — iP (V) holds, where 


-lPE (y) = (YrGT ^ yPOT max) AND (V < VmIN drag) AND (y — ySPEED max) 


— iPE (V) = IP AND (ypOTTGT = YPOT MIn)J OR IQ AND (ypOTTGT = YPOT MAx)J 


and 

P = (yrGT ^ ySPEED max) Q = (yrGT ^ ySPEED min)- 

By definition of —.PE (V), there are two possible cases for evaluation: (i) the conditions P and 
(ypoTTGT = ypoTMiN) hold; or else (ii) the conditions Q and (ypoTTGT = Ypotmax) hold. Since the 
Altitude Command supermode is selected and PE (y) —.PE (V) holds by hypothesis, according to the 
Altitude Command supermode selection strategy the Altitude Capture/Hold supermode is selected in 
both cases. 

Case (i)- Assume that the conditions P and ( ypoT tgt = Ypotmin) hold. According to the strategy for 
setting the target thrust, there are three subcases that correspond to the resulting condition 
(ypoTTGT = ypoT min)' Either (a) the thrust saturation condition (y < yspEED min) holds; or else (b) thrust 
is unsaturated and Q holds; or else (c) thrust is unsaturated and — .P — .Q holds, in which case ypoT tgt 
is not updated, but could previously have been set to ypoT min- 

(a) Assume that the condition (y< Yspeed min) holds. Since the Altitude Capture/Hold supermode is 
selected, the flightpath angle y is driven toward the flightpath target yrGT by the stability property 
of the path regulator. Since P = (yrGT ^ yspEED max) holds by assumption, if the Altitude Capture/ 
Hold supermode were to remain selected until path capture were complete, the condition 
(y> y S PEED max) would hold. In that case, the initial condition (y < Yspeed min) would change to 
the final condition (y > Yspeed max) during path capture. As a consequence of the physical condi- 
tion (ypoTMiN < ypoTMAx), the condition (Yspeed min < ysPEED max) holds by definition. Therefore, 
provided that the Altitude Capture/Hold supermode remains selected, the intermediate condition 
(yspEEDMiN < y < ysPEED max) must hold at some time during path capture because of the physical 
continuity of the flightpath angle y. In that case, thrust is unsaturated. Since P also holds by 
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assumption, Ypottgt is reset to Ypot max according to the strategy for setting target thrust. Then 
PE (V) holds by definition. Therefore, PE (y) PE (V) holds, demonstrating the theorem for 
subcase (a). 

(b) Assume that thrust is unsaturated and Q holds. Since P also holds by the assumption of case (i), 
PQ must hold. But since the condition (Yspeedmin < Yspeedmax) holds by definition, the condition 
PQ is impossible. Therefore, subcase (b) is impossible. 

(c) Assume that thrust is unsaturated and — iP — iQ holds. Since the assumption that — .P holds contra- 
dicts the assumption of case (i) that P holds, subcase (c) is impossible. 

Since the theorem holds for subcase (a), and since both subcase (b) and subcase (c) were shown to 
be impossible, the theorem holds for case (i). 

Case (ii)- Assume that the conditions Q and (Ypottgt = Ypot max) hold. According to the strategy 
for setting the target thrust, there are three subcases that correspond to the resulting condition 
(Ypottgt = Ypot max)- Either (a) the thrust saturation condition (Y^ Yspeedmax) holds; or else (b) 
thrust is unsaturated and P holds; or else (c) thrust is unsaturated and — iP — iQ holds, in which case 
Ypottgt is not updated, but could previously have been set to Ypot max- 

(a) Assume that the condition (y > Yspeed max) holds. Since the Altitude Capture/Hold supermode is 
selected, the flightpath angle y is driven toward the flightpath target Ytgt by the stability property 
of the path regulator. Since Q = (Ytgt ^ Yspeedmin) holds by assumption, if the Altitude Capture/ 
Hold supermode were to remain selected until path capture were complete, the condition 

(Y - Yspeed min) would hold. In that case, the initial condition (y > Yspeed max) would change to 
the final condition (Y^ Yspeedmin) during path capture. As a consequence of the physical condi- 
tion (Ypot min < Ypot max), the condition (Yspeedmin < Yspeedmax) holds by definition. Therefore, 
provided that the Altitude Capture/Hold supermode remains selected, the intermediate condition 
(Yspeedmin <y< Yspeedmax) rnust hold at some time during path capture because of the physical 
continuity of the flightpath angle y. In that case, thrust is unsaturated. Since Q also holds by 
assumption, Ypottgt is reset to Ypot min according to the strategy for setting target thrust. Then 
PE (V) holds by definition. Therefore, PE (y) PE (V) holds, demonstrating the theorem for 
subcase (a). 

(b) Assume that thrust is unsaturated and P holds. Since Q also holds by the assumption of case (ii), 
PQ must hold. But since the condition (Yspeedmin < Yspeedmax) holds by definition, the condition 
PQ is impossible. Therefore, subcase (b) is impossible. 

(c) Assume that thrust is unsaturated and — iP — iQ holds. Since the assumption that — iQ holds contra- 
dicts the assumption of case (ii) that Q holds, subcase (c) is impossible. 

Since the theorem holds for subcase (a), and since both subcase (b) and subcase (c) were shown to 
be impossible, the theorem holds for case (ii). 

Since the theorem holds for both case (i) and case (ii), it is established in general. 


Theorem 4 (-.PE (y) PE (V) Recovery Theorem) 


Informal Statement 

If PE (y) is violated initially, but PE (V) holds, and if the Altitude Command supermode is selected 
and the target altitude Htgt remains fixed with Htgt ^ Hmax and if Climb effectiveness holds while 
in the Climb mode, then in the absence of total propulsion failure the condition PE (y) PE (V) must 
eventually hold. 

Informal Proof Outline 

By hypothesis, the Altitude Command supermode is selected and the condition — iPE (y) PE (V) 
holds, where 


— PE (y) = (Ytgt ^ Ypot max) AND (V < V min drag) AND (y > Yspeed max) 


— iPE (V) = [P AND (Ypottgt = Ypot min)] OP IQ AND (Ypottgt - Ypot max)] 


and 


P = (Ytgt ^ Yspeed max) Q = (Ytgt - Yspeed min)- 


According to the Altitude Command supermode selection strategy, the Climb/Descend supermode is 
selected. There are two cases depending on the altitude error AH: (i) the descent case AH < 0; and 
(ii) the climb case AH > 0. 

Case (i)- Assume that the condition (AH < 0) holds. Therefore, by the height regulator law, the 
condition (Ytgt < 0) holds for the flightpath target Ytgt- Since as a consequence of the definition 
of Hmax the condition (Ypotmax ^ 0.3 deg) must hold, and the condition (Ytgt < 0) also holds, it 
follows that the condition (Ytgt < 0 < y P oT max) must hold. Therefore, PE (y) holds by definition, 
contradicting the hypothesis that — iPE (y) holds. Therefore, case (i) (the descent case) is impossible. 

Case (ii)- Assume that the condition (AH > 0) holds. Since by hypothesis — iPE (y) PE (V) holds, 
according to the Altitude Command mode selection strategy the Climb mode is selected. By hypoth- 
esis, the climb effectiveness condition CE holds. Therefore, by the definition of climb effectiveness, 
the aircraft vertical velocity must remain strictly positive. It follows that, during operation in the 
Climb mode, the altitude error AH decreases monotonically toward zero. By the height regulator 
law, the target flightpath angle Ytgt is proportional to the altitude error AH for I AH I sufficiently 
small. Therefore, the flightpath target Ytgt also decreases monotonically toward zero for I AH I 
sufficiently small (that is, when the aircraft approaches the target altitude sufficiently closely from 
below). Since the condition (Ypotmax ^ 0.3 deg) holds by definition of Hmax, the condition 
(Ytgt < Ypotmax) must hold for IYtgtI sufficiently small. In that case, PE (y) holds by definition. 
Therefore, since PE (V) holds by hypothesis, the condition PE (y) PE (V) must hold, and the 
theorem is demonstrated for case (ii). 

Since the theorem holds for case (ii) and since case (i) was shown to be impossible, the theorem is 
established in general. 
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EFFECTIVENESS OF ALTITUDE COMMAND SUPERMODE 


This section presents a theorem (Theorem 5) concerned with the effectiveness of the Altitude 
Command Supermode, which requires capture of altitude and airspeed targets (Volume I (Synthesis 
of Altitude Command Supermode)). In the absence of design error, effectiveness of the Altitude 
Command Supermode should be guaranteed by the design synthesis process (Volume I). Therefore, 
the theorem to be presented next (Theorem 5) provides an independent check of the integrity of the 
system design process described in Volume 1. 

Theorem 5 (Altitude Command Supermode Effectiveness Theorem) 

Informal Statement 

If the target altitude H T gt lies at or below H M ax and Htgt remains fixed, and if climb effectiveness 
holds while in the Climb mode, and if descent effectiveness holds while in the Descend mode, then 
selection of the Altitude Command supermode ensures that 

(a) the target altitude Htgt will be captured; and 

(b) if normal effectiveness of the "/Command mode holds while in the Altitude Capture/Hold mode, 
then the target airspeed V T gt will also be captured. 

Informal Proof Outline 

By definition of Hmax, the condition ("/pot max - 0.3 deg) holds at H M ax and at all lower altitudes. 
Since by hypothesis the condition (Htgt ^ Hmax) holds, the condition ("/pot max ^ 0.3 deg) must 
hold in the neighborhood of Htgt- 

In general, four cases are possible initially for the Altitude Command supermode: 

(i) — iPE (y) — iPE (V) 

(ii) PE (y) — iPE (V) 

(iii) — iPE (y) PE(V) 

(iv) PE (y) PE (V) 

Case (i)- Assume that the condition -.PE (y) — .PE (V) holds initially. By Theorem 2 
(— iPE (y) — iPE (V) Recovery Theorem), the condition — iPE (y) — iPE (V) cannot hold except in the 
short term. According to the recovery theorem, recovery to the condition PE (y) —.PE (V) (case (ii)), 
the condition —.PE (y) PE (V) (case (iii)), or the condition -.PE (y) —.PE (V) (case (iv)) must occur 
before the target airspeed V T gt is captured. Therefore, case (i) need not be considered further. 

Case (ii)- Assume that the condition PE (y) —.PE (V) holds. By Theorem 3 (PE (y) —.PE (V) 
Recovery Theorem), —.PE (y) —.PE (V) cannot hold except in the short term, and terminates in the 
condition PE (y) PE (V) (that is, in case (iv)). Therefore, case (ii) need not be considered further. 

Case (iii)- Assume that the condition —.PE (y) PE (V) holds. Since by hypothesis the Altitude 
Command supermode is selected and the target altitude Htgt remains fixed with Htgt ^ Hmax, by 
Theorem 4 (—.PE (y) PE (V) Recovery Theorem), the condition PE (y) PE (V) must eventually hold. 
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Therefore, case (iii) terminates in the condition PE (y) PE (V) (that is, in case (iv)). Therefore, case 
(iii) need not be considered further. 

Case (iv)- Because it has been demonstrated that the abnormal conditions for case (i), case (ii), and 
case (iii) terminate in the normal condition PE (y) PE (V) (that is, case (iv)), the normal condition 
PE (y) PE (V) must eventually hold. Therefore, according to the supermode selection strategy for the 
Altitude Command supermode, there are two cases for supermode selection: either the condition 
PuQ holds, resulting in the selection of the Climb/Descend supermode, or else the condition 
— iP — iQ holds, resulting in the selection of the Altitude Capture/Hold supermode. Furthermore, if 
PuQ holds and the condition (AH > 0) holds for the altitude error AH, then the Climb mode is 
selected, and if P u Q holds and the condition (AH < 0) holds, then the Descend mode is selected. 
Therefore, the following three subcases must be considered: (a) P u Q and the climb condition 
(AH > 0) hold; (b) P u Q and the descent condition (AH < 0) hold; and (c) the condition — iP — iQ 
holds. 

(a) Assume that PuQ and the climb condition (AH > 0) hold. In that case, by definition of the 
altitude error AH (Volume I), the target altitude H T gt lies above the initial altitude. By the height 
regulator law, the flightpath target yrGT has the same sign as the altitude error AH. Therefore, the 
condition (yrGT ^ 0) holds. Since the condition (yspEED min < 0) holds by the property of the 
longitudinal acceleration limiter, and since the condition (yrGT ^ 0) also holds, the condition 
Q = (^gt ^ Yspeed min) cannot hold. Therefore, since PuQ holds by assumption, P must hold 
initially. 

Since by assumption PE (y) PE (V) holds, and since by assumption PuQ and the condition 
(AH > 0) also hold, according to the Altitude Command mode selection strategy the Climb mode 
is selected. By hypothesis, the climb effectiveness condition CE holds. Therefore, according to 
the definition of climb effectiveness (Volume 1), the aircraft vertical velocity must remain 
strictly positive. It follows that, during operation in the Climb mode, the absolute altitude error 
I AH I decreases monotonically toward zero, provided that Htgt remains fixed as required by the 
hypothesis. According to the height regulator law, the target flightpath angle yrGT is proportional 
to the absolute altitude error I AH I fori AH I sufficiently small. Therefore, the absolute flightpath 
target I YtgtI also decreases monotonically toward zero for I AH I sufficiently small (that is, when 
the aircraft approaches the target altitude sufficiently closely from below). 

Since the condition (Ypot max ^ 0.3 deg) holds by definition of H M ax, the condition 
(Yspeed max > 0.3 deg) must hold by the property of the speed regulator. Therefore, the condition 
-,P = (Yt G t < Yspeed max) must hold for I YtgtI sufficiently small, contradicting the assumption of 
subcase (a) that PuQ holds. 

Because it was demonstrated that Q cannot hold, the condition — iP — iQ must hold (subcase (c)) 
for I YtgtI sufficiently small, which results in selection of the Altitude Capture/Hold supermode 
according to the Altitude Command supermode selection strategy. Therefore, operation in the 
Climb mode (that is, subcase (a)) terminates in selection of the Altitude Capture/Hold supermode 
when the aircraft approaches the target altitude sufficiently closely. 
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(b) Assume that PuQ and the condition (AH < 0) hold. In that case, by definition of the altitude 
error AH (Volume I), the target altitude Htgt lies below the initial altitude. By the height 
regulator law, the flightpath target Ytgt has the same sign as the altitude error AH. Therefore, the 
condition (Ytgt < 0) holds. Since the condition (Ypotmax ^ 0.3 deg) holds by definition of Hmax, 
the condition (Yspeedmax > 0.3 deg) must hold by the property of the speed regulator. Therefore, 
since the condition (Ytgt < 0) also holds, the condition P s (Ytgt ^ Yspeedmax) cannot hold. 
Therefore, since PuQ holds by assumption, Q must hold initially. 

Since by assumption PE (y) PE (V) holds, and since by assumption PuQ and the condition 
(AH < 0) also hold, according to the Altitude Command mode selection strategy the Descend 
mode is selected. By hypothesis, the descent effectiveness condition DE holds. Therefore, 
according to the definition of descent effectiveness (Volume I), the aircraft vertical velocity must 
remain strictly negative. It follows that, during operation in the Descend mode, the absolute 
altitude error I AH I decreases monotonically toward zero, provided that Htgt remains fixed as 
required by the hypothesis. According to the height regulator law, the target flightpath angle Ytgt 
is proportional to the altitude error AH for I AH 1 sufficiently small. Therefore, the flightpath 
target I YtgtI also decreases monotonically toward zero for I AH I sufficiently small (that is, when 
the aircraft approaches the target altitude sufficiently closely from above). 

Since the condition (Yspeedmin < 0) holds by the property of the longitudinal acceleration limiter, 
the condition — .Q = (Ytgt > Yspeed min) must hold for I YtgtI sufficiently small, contradicting the 
assumption of subcase (b) that PuQ holds. 

Because it was demonstrated that P cannot hold, the condition — iP — iQ must hold (subcase (c)) 
for I YtgtI sufficiently small, which results in selection of the Altitude Capture/Hold supermode 
according to the Altitude Command supermode selection strategy. Therefore, operation in the 
Descend mode (that is, subcase (b)) terminates in selection of the Altitude Capture/Hold 
supermode when the aircraft approaches the target altitude sufficiently closely. 

(c) Because it was demonstrated that both subcase (a) and subcase (b) terminate in the condition 
— iP — iQ (that is, in subcase (c)) when the aircraft approaches the target altitude sufficiently 
closely, — iP — iQ must eventually hold. Because it was demonstrated that PE (y) PE (V) must also 
hold eventually, the condition PE (y) PE (V) — iP — iQ must hold eventually. Therefore, according 
to the Altitude Command mode selection strategy, the Altitude Capture/Hold supermode is then 
selected. Since PE (y) holds, by definition of PE (y) capture of the flightpath target Ytgt is 
assured. Therefore, capture of the target altitude Htgt is assured by the stability property of the 
height regulator, establishing the first claim. 

Since PE (y) holds, by definition of PE (y) an acceptable point of airspeed equilibrium is cap- 
tured, although in general this equilibrium airspeed differs from the target airspeed. By defini- 
tion, normal effectiveness of the y Command mode (Volume I) requires that the longitudinal 
acceleration have the correct sign leading to capture of the target airspeed Vtgt- By hypothesis, 
normal effectiveness of the y Command mode holds while the Altitude Capture/Hold supermode 
is selected. It follows that the airspeed target Vtgt must be captured, establishing the second 
claim. 

Therefore, the theorem is established. 
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CORRECTION OF A DESIGN OVERSIGHT 


During the synthesis process, a design oversight was committed by assuming tacitly that maximum 
thrust would always be computationally distinct from minimum thrust, ignoring the possibility of 
total propulsion failure. For multiengine transport aircraft, the probability of such a failure is small, 
but not negligible. Since all engines depend on the aircraft fuel system, fuel contamination could 
cause simultaneous failure. Furthermore, incidents have occurred in which fuel mismanagement by 
the human flight crew resulted in an attempt to feed all engines from empty fuel tanks while other 
tanks contained fuel, leading to total propulsion failure that was soon corrected. 

In our opinion, such emergency situations should not be complicated by anomalous actions of the 
flight control system that result from failure to account for the possibility of total propulsion failure 
at the design level. Therefore, total propulsion failure should be considered in control system design. 

Error Identification 

The logic error resulting from this oversight was revealed during attempted formal proof of the 
Performance Degradation Theorem (Theorem 1 ). It can be seen that step 5 of Lemma B establishes 
the condition TT2 — iTTl, but since by definition 

TT I = (Ypot tgt = Ypot min) and TT2 = (Ypot tgt = Ypot max), 

the required condition TT2 — iTTl does not hold during total propulsion failure, because in that case 
the condition PF1 = (Ypotmax = Ypotmin) holds. 

Strategy for Setting Target Thrust 

Further consideration of the strategy for setting target thrust (table 5, Volume I) then showed that 
the original table was logically incomplete because the case in which both the conditions 
TS 1 = (y< Yspced min) and TS2 = (y> Yspeed max) hold simultaneously had erroneously been consid- 
ered logically impossible. Therefore, the original thrust setting strategy (table F-l) was logically 
indeterminate in the event of total propulsion failure. 

TABLE F-1. ORIGINAL STRATEGY FOR SETTING TARGET THRUST 


TS1 

TS2 


— iTSl — ,TS2 




Q 

P 

-p -iQ 

Set 

Set 

Set 

Set 

Ypot tgt 

TTI 

TT2 

TTI 

TT2 

not 

TRUE 

TRUE 

TRUE 

TRUE 

updated 
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In that case, several possible actions could result, depending on the exact details of the implementa- 
tion code. Target thrust might be set to minimum thrust (TT1 ), or to maximum thrust (TT2), or not 
be set at all (in that case, the previous setting would prevail), or a thrust setting error might be 
annunciated, or the autothrottle might be disconnected (with unpredictable consequences for the 
subsequent motion of the aircraft if normal engine operation should be restored). In our opinion, 
such behavioral uncertainties should be considered unacceptable in a safety-critical system. 

Correction of Error 

After the design error was identified, case analysis was applied to the logically complete set of cases 

TSI-iTS2 TSITS2 — iTS 1 TS2 ^TSl ^TS2 

to determine the best thrust setting strategy. This analysis resulted in the revised strategy as follows 
(table F-2). 


TABLE F-2. REVISED STRATEGY FOR SETTING TARGET THRUST 


PF1 



— iPFl 




TS1 

TS2 


— iTSl — ,TS2 





Q 

P 

-«P -iQ 

Set 

Set 

Set 

Set 

Set 

Ypottgt 

TT1 

TT1 

TT2 

TT1 

TT2 

not 

TRUE 

TRUE 

TRUE 

TRUE 

TRUE 

updated 


It can be seen that in case of total propulsion failure, the target thrust is set to minimum thrust (TT1) 
in order to minimize the thrust transient if normal engine operation is restored. 

Discussion 

This case history shows by example how formal proofs of system properties can provide an inde- 
pendent check of system design integrity. It should be noted that omission of the total propulsion 
failure case was not revealed by informal proof. It seems likely that, in most cases in which attempt- 
ed formal proof of a theorem reveals that some case has been omitted through oversight, the situa- 
tion could be dealt with by a trivial strengthening of the hypothesis of the theorem so as to rule out 
the omitted case. In the exceptional case just described, it was decided that design iteration was 
necessary to remedy the logic error, instead of ruling out the total propulsion failure case because of 
its low probability. 
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CONCLUDING REMARKS 


Several theorems have been presented that summarize the behavioral properties of the hybrid system 
for transport aircraft longitudinal control, which is the subject of Volume 1. These theorems enable 
theoretical assessment of system dynamical behavior and verification of system safety and effective- 
ness independent of the design method. They can therefore provide an independent check of system 
design integrity, enabling formal validation of the complete system to be achieved. 

Methods have been demonstrated for generating formal proofs of these behavioral theorems based 
on informal dynamical analysis. However, formal proof of such behavioral theorems by manual 
pencil-and-paper methods may be too complex and laborious for routine use by the aircraft industry. 
On the other hand, informal proof is not sufficiently rigorous to provide a check of system design 
integrity, as shown by a case study involving omission through oversight of a total propulsion failure 
case. 

Resolution of this dilemma can be achieved by using currently available theorem-proving software 
to generate formal proofs. To enable such machine-generated formal proofs to be checked manually 
if desired, a sequential listing of the detailed steps should be provided for each proof. Practical 
working methods for achieving partial automation of formal proofs by means of theorem-proving 
software are undercurrent investigation. 

By means of automated hypothesis testing, any hypothesis could in principle be tested to determine 
whether it is a theorem of the formal system. In future system development making use of the syn- 
thesis methods described in this report, such hypothesis testing could play a role similar to that of 
simulation in today's development process, but unlike simulation it would lead to results that would 
be rigorous and logically complete. 
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APPENDIX G 

SELECTED TRANSPORT AIRCRAFT ACCIDENTS AND INCIDENTS 


The following statements briefly summarize the aspects of four selected transport aircraft accidents 
and incidents that are considered relevant to issues of system design. Available references should be 
consulted for more complete accounts of these occurrences. 


L-1011, EVERGLADES, 1972 

After encountering an indication of unsafe nose landing gear extension during a night approach to 
the Miami airport, the aircraft requested and received radar vectors from Miami Approach Control to 
a nearby area where troubleshooting of the landing gear problem could be conducted with minimal 
conflict with other traffic. The assigned altitude was 2000 ft above ground level, and the assigned 
airspace was over the Everglades swamp in an area without lights on the ground. The autopilot was 
operating in its barometric altitude hold mode. At one point in the troubleshooting procedure, the 
first officer was required to enter the nose tunnel in order to make a visual inspection of the position 
of the nose gear strut. It is believed that in leaving his seat, the first officer may have bumped the 
control column, which would have caused the autopilot to change modes. Alternatively, the mode 
reversion may have resulted from some other cause. 

Whatever the cause, the autopilot reverted from the barometric hold mode, in which it was engaged, 
to the pitch attitude hold mode, which held the pitch attitude at which the aircraft had last been 
trimmed. The annunciation of this mode reversion was cautionary in nature, in contrast to the warn- 
ing provided for complete disconnect of the autopilot, and failed to claim the attention of the crew. 
The target pitch attitude held by the autopilot then allowed the aircraft to descend slowly below the 
assigned altitude. The crew failed to monitor the system performance adequately because they were 
distracted from their normal duties by the elaborate procedure required for troubleshooting the 
landing gear problem. The absence of lights on the ground also contributed to their lack of altitude 
awareness. The aircraft struck the surface of the swamp and was totally destroyed, with heavy loss 
of life. (NTSB. 1972). 


B-767, SAN FRANCISCO, LATE 1980s 

Several altitude violations on departure from San Francisco led to an investigation. Within the 
autoflight system of the aircraft, it was found that the conditional branching that governed the 
transition from the climb mode to the altitude capture mode contained a test for validity of the 
vertical velocity, a common programming strategy intended to defend the altitude capture routine 
against invalid input data. If the vertical velocity were invalid, execution would be transferred to the 
exit from the climb routine, skipping the test for transition to the altitude capture mode. Validity of 
the vertical velocity was determined by a reasonableness test that examined whether the vertical 
velocity lay within the expected range specified a priori. 
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But at light aircraft weight and lower-than-standard atmospheric temperature, and for northeast 
departures not requiring noise abatement procedures using partial thrust, the vertical velocity during 
climb could reach values that lay outside the tolerance limit imposed by the reasonableness test. 
Under these seldom-encountered conditions, the reasonableness test generated false indications of 
invalid vertical velocity that caused the test for transition to the altitude capture mode to be skipped, 
so that the system remained by default in the climb mode. The result was that the aircraft failed to 
level off at the assigned altitude. No annunciation was provided to the crew. These altitude over- 
shoots violated the traffic separation required by Air Traffic Control (ATC), and could have resulted 
in a catastrophic midair collision. (Lauber, J. K., Member, National Transportation Safety Board, 
personal communication, 1994.) 


B-737, DENVER, EARLY 1990s 

In airline training simulations, failure of the glideslope receiver during instrument landing system 
(ILS) approach is often simulated. The autoflight system reverts from ILS approach mode to the 
vertical velocity hold mode. This mode reversion is annunciated by the vanishing of a small symbol 
on the primary flight display, a cautionary annunciation that is frequently overlooked by the crew. 
The system then holds the vertical velocity that prevailed at the instant of failure, a situation that 
could cause the aircraft to fly into the ground short of the runway. Identical system behavior in the 
aircraft has been verified. (Irving, Capt. James, United Airlines, personal communication, 1996.) 


A-330, TOULOUSE, JUNE 1994 

This accident occurred during a test flight commanded by the manufacturer's chief pilot. Immedi- 
ately following takeoff at light weight and with center of gravity far aft. the flight test card required 
the pilot to engage the autoflight system and then simulate engine failure by cutting one engine. (The 
A-330 is a twin-engine aircraft.) The purpose of the test, which had been carried out successfully 
with engines of a different type, was to verify that safe airspeed margins were preserved following 
the simulated engine failure. 

Other demonstrations had been conducted earlier in the flight, and a target altitude of 2000 ft above 
ground level remained in the system from a previous entry. With this target altitude and the unusu- 
ally high rate of climb achieved shortly after takeoff under the test conditions, the system transi- 
tioned from the climb mode to the altitude capture mode immediately after engagement. In the 
altitude capture mode, the flightpath was commanded to follow the specified altitude capture trajec- 
tory. Path error was fed back to pitch control, and with thrust fixed at maximum thrust there was no 
closed-loop control of airspeed. Furthermore, an automatic de-clutter mode would remove mode 
annunciations from the primary flight display at nose-high pitch attitudes exceeding 25 deg. 

The crew may not have appreciated the significance of the reversion to the altitude capture mode, or 
alternatively they may not have been aware of it. They cut the engine as required by the flight test 
card at an airspeed of about 150 kt. The thrust available with one engine out was inadequate for 
steady climb at the commanded path angle, so the airspeed decayed rapidly and the aircraft settled 
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below the commanded altitude capture trajectory. The system responded by increasing pitch attitude 
to excessive nose-high angles that reached 32 deg, which increased the rate of decay of airspeed. 

The airspeed decayed below the minimum-control speed of 1 18 kt, and the aircraft began an uncon- 
trollable roll into the dead engine. According to the Director General of Armaments’ report (1994), 
the crew was slow in deciding to take over manually, although their decision may have been delayed 
by the automatic de-cluttering of the primary display, which removed mode annunciations. The pilot 
attempted to recover roll control by cutting the remaining engine, which also disabled the envelope 
protection based on angle of attack (the “alpha floor”). But sufficient altitude for recovery was not 
available, and the aircraft stalled and crashed, reaching airspeeds as low as 77 kt before the impact. 
The aircraft was totally destroyed, with fatal injuries to all those on board. 
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